Cancel remote control enrollment on stdio shutdown (#42668)

## Why

A pending remote control enrollment could prevent the app server from exiting
after stdio EOF, leaving resources such as thread writers held by the process.

## What changed

- Give remote control its own child shutdown token and cancel it before draining
  RPCs when the stdio connection closes.
- Interrupt enrollment requests that require network access after shutdown has
  begun, while still allowing in-memory or persisted enrollments to be enabled
  and durably saved.

## Testing

- Cover stdio shutdown during a blocked enrollment and verify that another app
  server can acquire the released thread writer.
- Cover durable enablement after shutdown with in-memory, persisted, and missing
  enrollments.

GitOrigin-RevId: ef9ab49672f273a4cf8257188454a154c03088bd

codex-rs/app-server/src/lib.rs

@@ -731,6 +731,8 @@ pub async fn run_main_with_transport_options(
     }
     let installation_id = resolve_installation_id(&config.codex_home).await?;
     let transport_shutdown_token = CancellationToken::new();
+    // Remote enrollment must cancel before RPC drain without shutting down telemetry.
+    let remote_control_shutdown_token = transport_shutdown_token.child_token();
     let mut transport_accept_handles = Vec::<JoinHandle<()>>::new();
 
     let single_client_mode = matches!(&transport, AppServerTransport::Stdio);
@@ -809,7 +811,7 @@ pub async fn run_main_with_transport_options(
         state_db.clone(),
         auth_manager.clone(),
         transport_event_tx.clone(),
-        transport_shutdown_token.clone(),
+        remote_control_shutdown_token.clone(),
         app_server_client_name_rx,
         remote_control_startup_mode,
     )
@@ -1051,6 +1053,8 @@ pub async fn run_main_with_transport_options(
                                     break "outbound_router_closed";
                                 }
                                 if single_client_mode && stdio_closed {
+                                    // Pending remote enrollment must stop before RPCs drain.
+                                    remote_control_shutdown_token.cancel();
                                     break "stdio_connection_closed";
                                 }
                             }