Add new enterprise requirement gate (#23736)

Add new enterprise requirement gate.

Validation:
- `cargo test -p codex-config --lib`
- `cargo test -p codex-app-server-protocol --lib`
- `cargo test -p codex-tui --lib debug_config`
- `cargo test -p codex-app-server --lib` *(fails: stack overflow in
`in_process::tests::in_process_start_initializes_and_handles_typed_v2_request`;
reproduces when run alone)*

codex-rs/core/src/config/config_loader_tests.rs

@@ -1101,6 +1101,7 @@ allowed_approval_policies = ["on-request"]
                 remote_sandbox_config: None,
                 allowed_web_search_modes: None,
                 allow_managed_hooks_only: None,
+                allow_appshots: None,
                 computer_use: None,
                 feature_requirements: None,
                 hooks: None,
@@ -1161,6 +1162,7 @@ allowed_approval_policies = ["on-request"]
             remote_sandbox_config: None,
             allowed_web_search_modes: None,
             allow_managed_hooks_only: None,
+            allow_appshots: None,
             computer_use: None,
             feature_requirements: None,
             hooks: None,
@@ -1370,6 +1372,7 @@ async fn load_config_layers_includes_cloud_requirements() -> anyhow::Result<()>
         remote_sandbox_config: None,
         allowed_web_search_modes: None,
         allow_managed_hooks_only: None,
+        allow_appshots: None,
         computer_use: None,
         feature_requirements: None,
         hooks: None,

codex-rs/core/src/config/config_tests.rs

@@ -8098,6 +8098,7 @@ async fn test_requirements_web_search_mode_allowlist_does_not_warn_when_unset()
         remote_sandbox_config: None,
         allowed_web_search_modes: Some(vec![codex_config::WebSearchModeRequirement::Cached]),
         allow_managed_hooks_only: None,
+        allow_appshots: None,
         computer_use: None,
         feature_requirements: None,
         hooks: None,
@@ -8820,6 +8821,7 @@ async fn explicit_sandbox_mode_falls_back_when_disallowed_by_requirements() -> s
         remote_sandbox_config: None,
         allowed_web_search_modes: None,
         allow_managed_hooks_only: None,
+        allow_appshots: None,
         computer_use: None,
         feature_requirements: None,
         hooks: None,

codex-rs/core/src/config/mod.rs

@@ -2440,6 +2440,7 @@ impl Config {
             permission_profile: mut constrained_permission_profile,
             web_search_mode: mut constrained_web_search_mode,
             allow_managed_hooks_only: _,
+            allow_appshots: _,
             computer_use: _,
             feature_requirements,
             managed_hooks: _,