[codex] reduce module visibility (#16978)

## Summary
- reduce public module visibility across Rust crates, preferring private
or crate-private modules with explicit crate-root public exports
- update external call sites and tests to use the intended public crate
APIs instead of reaching through module trees
- add the module visibility guideline to AGENTS.md

## Validation
- `cargo check --workspace --all-targets --message-format=short` passed
before the final fix/format pass
- `just fix` completed successfully
- `just fmt` completed successfully
- `git diff --check` passed

codex-rs/utils/cli/src/lib.rs

@@ -1,8 +1,9 @@
 mod approval_mode_cli_arg;
 mod config_override;
-pub mod format_env_display;
+pub(crate) mod format_env_display;
 mod sandbox_mode_cli_arg;
 
 pub use approval_mode_cli_arg::ApprovalModeCliArg;
 pub use config_override::CliConfigOverrides;
+pub use format_env_display::format_env_display;
 pub use sandbox_mode_cli_arg::SandboxModeCliArg;

codex-rs/utils/image/src/lib.rs

@@ -2,7 +2,6 @@ use std::num::NonZeroUsize;
 use std::path::Path;
 use std::sync::LazyLock;
 
-use crate::error::ImageProcessingError;
 use base64::Engine;
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
 use codex_utils_cache::BlockingLruCache;
@@ -21,7 +20,9 @@ pub const MAX_WIDTH: u32 = 2048;
 /// Maximum height used when resizing images before uploading.
 pub const MAX_HEIGHT: u32 = 768;
 
-pub mod error;
+pub(crate) mod error;
+
+pub use crate::error::ImageProcessingError;
 
 #[derive(Debug, Clone)]
 pub struct EncodedImage {

codex-rs/utils/path-utils/src/lib.rs

@@ -1,6 +1,8 @@
 //! Path normalization, symlink resolution, and atomic writes shared across Codex crates.
 
-pub mod env;
+pub(crate) mod env;
+pub use env::is_headless_environment;
+pub use env::is_wsl;
 
 use codex_utils_absolute_path::AbsolutePathBuf;
 use std::collections::HashSet;

codex-rs/utils/pty/src/win/mod.rs

@@ -44,7 +44,7 @@ use winapi::um::processthreadsapi::*;
 use winapi::um::synchapi::WaitForSingleObject;
 use winapi::um::winbase::INFINITE;
 
-pub mod conpty;
+pub(crate) mod conpty;
 mod procthreadattr;
 mod psuedocon;