Accept explicit contribution context for MCP runtime configuration (#61283)

## What changed

- Make `McpManager::runtime_config` accept `McpServerContributionContext` and honor its originator, selected environments, and disabled plugin IDs.
- Add `McpServerContributionContext::for_host` to carry thread initialization data, originator, and session source without live extension state or discovery.
- Pass explicit global contexts from threadless discovery and control paths.

## Testing

Extend the thread manager test to cover host-only contribution identity, originator headers, and server restrictions for disabled plugins and pending environments.

GitOrigin-RevId: 04ea2c8951187d9014867f0020223b6a7dd94d8d

codex-rs/app-server/src/request_processors/apps_processor/installed.rs

@@ -4,6 +4,7 @@ use codex_connectors::ConnectorRuntimeTool;
 use codex_connectors::connector_runtime_context_key;
 use codex_connectors::connector_tool_is_synthetic;
 use codex_connectors::installed_connector_runtime;
+use codex_extension_api::McpServerContributionContext;
 use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_mcp::MCP_TOOL_CODEX_APPS_META_KEY;
 use codex_mcp::McpRuntime;
@@ -79,7 +80,7 @@ impl AppsRequestProcessor {
                         snapshot_age = Some(Duration::ZERO);
                         return Ok(snapshot.tools);
                     }
-                    let mcp_config = mcp_manager.runtime_config(&config).await;
+                    let mcp_config = mcp_manager.runtime_config(McpServerContributionContext::global(&config)).await;
                     let mut mcp_servers = effective_mcp_servers(&mcp_config, auth.as_ref());
                     let codex_apps_server = codex_mcp::McpServerKey::unscoped(CODEX_APPS_MCP_SERVER_NAME);
                     mcp_servers.retain(|key, _| key == &codex_apps_server);

codex-rs/app-server/src/request_processors/mcp_processor.rs

@@ -4,6 +4,7 @@ use super::thread_input::ensure_direct_input_allowed;
 use super::*;
 use codex_config::types::McpServerAuth;
 use codex_core::McpRefreshReason;
+use codex_extension_api::McpServerContributionContext;
 use codex_mcp::McpServerSource;
 use codex_mcp::ReadResourceRequestParams;
 use codex_mcp::ema_auth_scope;
@@ -156,7 +157,7 @@ impl McpRequestProcessor {
                 let mcp_config = self
                     .thread_manager
                     .mcp_manager()
-                    .runtime_config(&config)
+                    .runtime_config(McpServerContributionContext::global(&config))
                     .await;
                 let runtime_context = McpRuntimeContext::new(
                     self.thread_manager.environment_manager(),
@@ -458,7 +459,9 @@ impl McpRequestProcessor {
             let (mcp_config, runtime_context) = match thread.as_ref() {
                 Some(thread) => thread.runtime_mcp_config_and_context(&config).await,
                 None => (
-                    mcp_manager.runtime_config(&config).await,
+                    mcp_manager
+                        .runtime_config(McpServerContributionContext::global(&config))
+                        .await,
                     McpRuntimeContext::new(
                         self.thread_manager.environment_manager(),
                         config.cwd.to_path_buf(),
@@ -744,7 +747,9 @@ impl McpRequestProcessor {
 
         let config = self.load_global_config().await?;
         let mcp_manager = self.thread_manager.mcp_manager();
-        let mcp_config = mcp_manager.runtime_config(&config).await;
+        let mcp_config = mcp_manager
+            .runtime_config(McpServerContributionContext::global(&config))
+            .await;
         let codex_apps_tools_cache = mcp_manager.codex_apps_tools_cache();
         let tool_catalog_cache = mcp_manager.tool_catalog_cache();
         self.thread_manager