feat: add support for allowed_web_search_modes in requirements.toml

Example:

```toml
# This means that "live" is not allowed; "disabled" is allowed even though not listed explicitly.
allowed_web_search_modes = ["cached"]
```

### Why
- Support admin/MDM/requirements.toml constraints over web-search behavior, independent of user config or sandbox defaults.
- Ensure per-turn config resolution and review-mode overrides can never crash when constraints are present.
- Note that `allowed_web_search_modes = ["cached"]` denies `"live"`, even if `--yolo` is used. See `resolve_web_search_mode_for_turn()`.

### What
- Add `allowed_web_search_modes` to requirements parsing and app-server v2 `ConfigRequirements` (`allowedWebSearchModes`), with schema/TS fixture updates.
- Introduce TOML-only `WebSearchModeRequirement` for requirements allowlists; accept `disabled|cached|live`, and treat an empty list as `[disabled]`.
- Convert the allowlist to a `ConstrainedWithSource<Option<WebSearchMode>>`, always permitting `Disabled` while enforcing membership for other values.
- Make `Config.web_search_mode` a constrained field, update call sites/tests, and surface constraint violations via warnings/fallback.
- Extend TUI `/debug-config` output to display `allowed_web_search_modes`.

### Safety
- Avoid `expect()` on constrained `web_search_mode` mutation in session per-turn config and review-thread setup; warn and keep the constrained value instead.

codex-rs/core/tests/suite/model_tools.rs

@@ -36,7 +36,10 @@ async fn collect_tool_identifiers_for_model(model: &str) -> Vec<String> {
         .with_model(model)
         // Keep tool expectations stable when the default web_search mode changes.
         .with_config(|config| {
-            config.web_search_mode = Some(WebSearchMode::Cached);
+            config
+                .web_search_mode
+                .set(Some(WebSearchMode::Cached))
+                .expect("test web_search_mode should satisfy constraints");
             config.features.enable(Feature::CollaborationModes);
         });
     let test = builder

codex-rs/core/tests/suite/prompt_caching.rs

@@ -97,7 +97,10 @@ async fn prompt_tools_are_consistent_across_requests() -> anyhow::Result<()> {
             config.user_instructions = Some("be consistent and helpful".to_string());
             config.model = Some("gpt-5.1-codex-max".to_string());
             // Keep tool expectations stable when the default web_search mode changes.
-            config.web_search_mode = Some(WebSearchMode::Cached);
+            config
+                .web_search_mode
+                .set(Some(WebSearchMode::Cached))
+                .expect("test web_search_mode should satisfy constraints");
             config.features.enable(Feature::CollaborationModes);
         })
         .build(&server)

codex-rs/core/tests/suite/web_search.rs

@@ -34,7 +34,10 @@ async fn web_search_mode_cached_sets_external_web_access_false() {
     let mut builder = test_codex()
         .with_model("gpt-5-codex")
         .with_config(|config| {
-            config.web_search_mode = Some(WebSearchMode::Cached);
+            config
+                .web_search_mode
+                .set(Some(WebSearchMode::Cached))
+                .expect("test web_search_mode should satisfy constraints");
         });
     let test = builder
         .build(&server)
@@ -69,7 +72,10 @@ async fn web_search_mode_takes_precedence_over_legacy_flags() {
         .with_model("gpt-5-codex")
         .with_config(|config| {
             config.features.enable(Feature::WebSearchRequest);
-            config.web_search_mode = Some(WebSearchMode::Cached);
+            config
+                .web_search_mode
+                .set(Some(WebSearchMode::Cached))
+                .expect("test web_search_mode should satisfy constraints");
         });
     let test = builder
         .build(&server)
@@ -103,7 +109,10 @@ async fn web_search_mode_defaults_to_cached_when_unset() {
     let mut builder = test_codex()
         .with_model("gpt-5-codex")
         .with_config(|config| {
-            config.web_search_mode = None;
+            config
+                .web_search_mode
+                .set(None)
+                .expect("test web_search_mode should satisfy constraints");
             config.features.disable(Feature::WebSearchCached);
             config.features.disable(Feature::WebSearchRequest);
         });
@@ -148,7 +157,10 @@ async fn web_search_mode_updates_between_turns_with_sandbox_policy() {
     let mut builder = test_codex()
         .with_model("gpt-5-codex")
         .with_config(|config| {
-            config.web_search_mode = None;
+            config
+                .web_search_mode
+                .set(None)
+                .expect("test web_search_mode should satisfy constraints");
             config.features.disable(Feature::WebSearchCached);
             config.features.disable(Feature::WebSearchRequest);
         });