Support Daybreak selection in codex exec (#49856)

## What changed

- Add the `daybreak` configuration key, defaulting to `false`, with per-invocation overrides such as `-c daybreak=true`.
- Resolve access programs from the model catalog, preferring `daybreak_blue` over `daybreak_red` when enabled and selecting advertised `standard` access when disabled for signed-in ChatGPT accounts. Require the OpenAI provider, a signed-in ChatGPT account, and a compatible model to enable Daybreak.
- Save the choice for new persistent threads and inherit it on resume and fork, including ephemeral forks. Explicit CLI overrides apply only to the current invocation.

## Testing

Add protocol tests for advertised-program selection and exec integration tests for account and provider restrictions, saved choices, ephemeral forks, and invocation-only overrides.

GitOrigin-RevId: ac955f08b5a891e720cfc5f67fabb7b0f6d32bb8

codex-rs/protocol/src/openai_models/access_programs_tests.rs

@@ -0,0 +1,24 @@
+use super::ModelAccessPrograms;
+use crate::turn_input::CyberAccessProgram;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn selects_only_advertised_programs_with_blue_preferred() {
+    use CyberAccessProgram::*;
+    for (cyber, expected_daybreak, expected_standard) in [
+        (
+            vec![Standard, DaybreakRed, DaybreakBlue],
+            Some(DaybreakBlue),
+            Some(Standard),
+        ),
+        (vec![DaybreakRed], Some(DaybreakRed), None),
+        (vec![Standard], None, Some(Standard)),
+        (vec![], None, None),
+    ] {
+        let programs = ModelAccessPrograms { cyber };
+        assert_eq!(
+            (programs.daybreak(), programs.standard()),
+            (expected_daybreak, expected_standard)
+        );
+    }
+}