[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/cli/src/lib.rs

@@ -1,10 +1,21 @@
-pub mod debug_sandbox;
+pub(crate) mod debug_sandbox;
 mod exit_status;
-pub mod login;
+pub(crate) mod login;
 
 use clap::Parser;
 use codex_utils_cli::CliConfigOverrides;
 
+pub use debug_sandbox::run_command_under_landlock;
+pub use debug_sandbox::run_command_under_seatbelt;
+pub use debug_sandbox::run_command_under_windows;
+pub use login::read_api_key_from_stdin;
+pub use login::run_login_status;
+pub use login::run_login_with_api_key;
+pub use login::run_login_with_chatgpt;
+pub use login::run_login_with_device_code;
+pub use login::run_login_with_device_code_fallback_to_browser;
+pub use login::run_logout;
+
 #[derive(Debug, Parser)]
 pub struct SeatbeltCommand {
     /// Convenience alias for low-friction sandboxed automatic execution (network-disabled sandbox that can write to cwd and TMPDIR)