Add cloud-managed config layer support (#24620)

## Summary

PR 3 of 5 in the cloud-managed config client stack.

Adds enterprise-managed cloud config as a first-class config layer
source. The layer metadata is preserved through config loading,
diagnostics, debug output, hook attribution, and app-server protocol
surfaces.

## Details

- Enterprise-managed config becomes a normal config layer source with
backend-supplied `id` and display `name` attached for provenance.
- These layers are designed to behave like non-file managed config: they
can surface syntax/type diagnostics by layer name even though there is
no physical config file.
- Relative path settings are resolved from a stored config base so
cloud-delivered config remains consistent with existing MDM-delivered
config semantics.
- Hook attribution distinguishes config-delivered hooks from
requirements-delivered hooks via `HookSource::CloudManagedConfig`.
- This remains pull-based and snapshot-oriented; the PR adds layer
identity/diagnostics, not dynamic reload behavior.

## Validation

Validated through the targeted stack checks after rebasing onto current
`main`:

- Rust crate tests for
config/hooks/cloud-config/backend-client/app-server-protocol
- Filtered `codex-core` and `codex-app-server` `cloud_config_bundle`
tests
- Python generated-file contract test
- `cargo shear --deny-warnings`
- Targeted `argument-comment-lint` for config/hooks

codex-rs/app-server-protocol/src/protocol/v2/config.rs

@@ -43,6 +43,19 @@ pub enum ConfigLayerSource {
         file: AbsolutePathBuf,
     },
 
+    /// Enterprise-managed config layer delivered by the cloud config bundle.
+    #[serde(rename_all = "camelCase")]
+    #[ts(rename_all = "camelCase")]
+    EnterpriseManaged {
+        /// Stable identifier for the delivered layer.
+        id: String,
+
+        /// Admin-facing name for the delivered layer. This is surfaced in
+        /// diagnostics so users know which cloud layer needs administrator
+        /// attention.
+        name: String,
+    },
+
     /// User config layer from $CODEX_HOME/config.toml. This layer is special
     /// in that it is expected to be:
     /// - writable by the user
@@ -90,6 +103,7 @@ impl ConfigLayerSource {
         match self {
             ConfigLayerSource::Mdm { .. } => 0,
             ConfigLayerSource::System { .. } => 10,
+            ConfigLayerSource::EnterpriseManaged { .. } => 15,
             ConfigLayerSource::User { profile, .. } => {
                 if profile.is_some() {
                     21

codex-rs/app-server-protocol/src/protocol/v2/hook.rs

@@ -48,6 +48,7 @@ v2_enum_from_core!(
         SessionFlags,
         Plugin,
         CloudRequirements,
+        CloudManagedConfig,
         LegacyManagedConfigFile,
         LegacyManagedConfigMdm,
         Unknown,