Allow disabling the in-process code-mode host fallback (#35266)

## What changed

- Allow `features.code_mode_host` to use a configuration table with
  `disable_in_process_fallback`. When enabled, failure to start the standalone
  host is returned as tool output instead of falling back to embedded V8.
- Preserve the existing fallback behavior by default and continue accepting the
  boolean feature toggle.
- Limit displayed host paths in spawn errors to 512 bytes while retaining the
  executable-bearing suffix and valid UTF-8 boundaries.

## Testing

- Cover boolean and table-based feature configuration, fallback-disabled host
  failures, and bounded ASCII and UTF-8 error paths.

GitOrigin-RevId: ab3d014e79054c2f8beef9a658915f01cca197b2

codex-rs/code-mode/src/remote_session.rs

@@ -38,6 +38,7 @@ type ShutdownResultReceiver = watch::Receiver<Option<Result<(), String>>>;
 /// Creates code-mode sessions backed by one lazily spawned process host.
 pub struct ProcessOwnedCodeModeSessionProvider {
     state: StdMutex<ProviderState>,
+    allow_in_process_fallback: bool,
 }
 
 /// Creates code-mode sessions backed by one shared remote WebSocket connection.
@@ -56,9 +57,15 @@ impl ProcessOwnedCodeModeSessionProvider {
             state: StdMutex::new(ProviderState::OwnedProcess(Arc::new(
                 OwnedCodeModeHost::new(host_program),
             ))),
+            allow_in_process_fallback: true,
         }
     }
 
+    pub fn without_in_process_fallback(mut self) -> Self {
+        self.allow_in_process_fallback = false;
+        self
+    }
+
     fn process_host(&self) -> Option<Arc<OwnedCodeModeHost>> {
         match &*self
             .state
@@ -91,7 +98,7 @@ impl CodeModeSessionProvider for ProcessOwnedCodeModeSessionProvider {
 
             match process_host.connection().await {
                 Ok(_) => {}
-                Err(error) if error.host_program_not_found() => {
+                Err(error) if error.host_program_not_found() && self.allow_in_process_fallback => {
                     *self
                         .state
                         .lock()