Emit Trusted MCP App Identity on Tool-Call Items (#27132)

## Summary

- Add optional `appContext` to app-server MCP tool-call items with
trusted `connectorId`, `linkId`, and `mcpAppResourceUri` metadata.
- Preserve that context across tool-call events, persisted history,
reconnects, and thread resume.
- Keep the deprecated top-level `mcpAppResourceUri` temporarily for
client migration.

The consumer contract is `{ appContext: { connectorId, linkId,
mcpAppResourceUri }, tool }`.

## Validation

- Full GitHub Actions suite passes, including CLA, Bazel tests, clippy,
release builds, and argument-comment lint.

---------

Co-authored-by: martinauyeung-oai <280153141+martinauyeung-oai@users.noreply.github.com>

codex-rs/exec/src/event_processor_with_jsonl_output_tests.rs

@@ -98,6 +98,7 @@ fn mcp_tool_call_result_preserves_meta_in_jsonl_event() {
                 tool: "web_run".to_string(),
                 status: McpToolCallStatus::Completed,
                 arguments: json!({"search_query": [{"q": "OpenAI Codex CLI documentation"}]}),
+                app_context: None,
                 mcp_app_resource_uri: None,
                 plugin_id: None,
                 result: Some(Box::new(codex_app_server_protocol::McpToolCallResult {