Extract built-in tool spec constructors into codex-tools (#16493)

## Why

`core/src/tools/spec.rs` still had a few built-in tool specs assembled
inline even though those definitions are pure metadata and already live
conceptually in `codex-tools`. Keeping that construction in `codex-core`
makes `spec.rs` do more than registry orchestration and slows the
migration toward a right-sized `codex-tools` crate.

This continues the extraction stack from #16379, #16471, #16477, #16481,
and #16482.

## What Changed

- added `create_local_shell_tool()`, `create_web_search_tool(...)`, and
`create_image_generation_tool(...)` to `codex-rs/tools/src/tool_spec.rs`
- exported those helpers from `codex-rs/tools/src/lib.rs`
- switched `codex-rs/core/src/tools/spec.rs` to call those helpers
instead of constructing `ToolSpec::LocalShell`, `ToolSpec::WebSearch`,
and `ToolSpec::ImageGeneration` inline
- removed the remaining core-local web-search content-type constant and
made the affected spec test assert the literal expected values directly

This is intended to be a straight refactor: tool behavior and wire shape
should not change.

## Testing

- `cargo test -p codex-tools`
- `cargo test -p codex-core tools::spec::tests`

codex-rs/core/src/tools/spec_tests.rs

@@ -15,6 +15,7 @@ use codex_protocol::models::VIEW_IMAGE_TOOL_NAME;
 use codex_protocol::openai_models::InputModality;
 use codex_protocol::openai_models::ModelInfo;
 use codex_protocol::openai_models::ModelsResponse;
+use codex_protocol::openai_models::WebSearchToolType;
 use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SubAgentSource;
@@ -1277,12 +1278,7 @@ fn web_search_tool_type_text_and_image_sets_search_content_types() {
             filters: None,
             user_location: None,
             search_context_size: None,
-            search_content_types: Some(
-                WEB_SEARCH_CONTENT_TYPES
-                    .into_iter()
-                    .map(str::to_string)
-                    .collect()
-            ),
+            search_content_types: Some(vec!["text".to_string(), "image".to_string()]),
         }
     );
 }