Enforce environment MCP policies (#39335)

## What changed

- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.

## Testing

- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.

GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e

codex-rs/protocol/src/environment.rs

@@ -1,5 +1,6 @@
 use crate::capabilities::SelectedCapabilityRoot;
 use crate::config_types::ShellEnvironmentPolicy;
+use crate::mcp_policy::EnvironmentMcpPolicy;
 use crate::models::PermissionProfileSnapshot;
 use codex_execpolicy::RequirementsExecPolicy;
 use codex_network_proxy::EnvironmentNetworkPolicy;
@@ -29,6 +30,8 @@ pub struct EnvironmentConfig {
     pub shell_environment_policy: ShellEnvironmentPolicy,
     /// Additional managed command restrictions for this environment attachment.
     pub exec_policy: Option<RequirementsExecPolicy>,
+    /// Additional managed MCP restrictions for this environment attachment.
+    pub mcp_policy: Option<EnvironmentMcpPolicy>,
     /// Owner-provided traffic restrictions. `None` keeps the existing controller policy.
     /// Core rejects `Some` until attachment-owned network enforcement is implemented.
     pub network_policy: Option<EnvironmentNetworkPolicy>,
@@ -44,6 +47,7 @@ impl std::fmt::Debug for EnvironmentConfig {
             .field("permission_profile", &self.permission_profile)
             .field("shell_environment_policy", &"<redacted>")
             .field("exec_policy", &self.exec_policy)
+            .field("mcp_policy", &self.mcp_policy)
             .field("network_policy", &self.network_policy)
             .field("selected_capability_roots", &self.selected_capability_roots)
             .finish()

codex-rs/protocol/src/mcp_policy.rs

@@ -1,6 +1,13 @@
 use serde::Deserialize;
 use std::collections::BTreeMap;
 
+/// Additional managed MCP restrictions supplied by an environment owner.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct EnvironmentMcpPolicy {
+    pub servers: Option<BTreeMap<String, McpServerRequirement>>,
+    pub plugins: Option<BTreeMap<String, PluginMcpRequirements>>,
+}
+
 #[derive(Deserialize, Debug, Clone, PartialEq, Eq)]
 #[serde(untagged)]
 pub enum McpServerIdentity {