[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/shell-escalation/src/unix/mod.rs

@@ -53,15 +53,16 @@
 //!   |      |
 //!   o<-----x
 //!
-pub mod escalate_client;
-pub mod escalate_protocol;
-pub mod escalate_server;
-pub mod escalation_policy;
-pub mod execve_wrapper;
-pub mod socket;
-pub mod stopwatch;
+pub(crate) mod escalate_client;
+pub(crate) mod escalate_protocol;
+pub(crate) mod escalate_server;
+pub(crate) mod escalation_policy;
+pub(crate) mod execve_wrapper;
+pub(crate) mod socket;
+pub(crate) mod stopwatch;
 
 pub use self::escalate_client::run_shell_escalation_execve_wrapper;
+pub use self::escalate_protocol::ESCALATE_SOCKET_ENV_VAR;
 pub use self::escalate_protocol::EscalateAction;
 pub use self::escalate_protocol::EscalationDecision;
 pub use self::escalate_protocol::EscalationExecution;