standalone websearch extension (#23823)

## Summary

Add the extension-backed standalone `web.run` tool so Codex can call the
standalone search endpoint through the `codex-api` search client and
return its encrypted output to Responses.

- gate the new tool behind `standalone_web_search`
- install the extension in the app-server thread registry and hide
hosted `web_search` when standalone search is enabled for OpenAI
providers so the two paths stay mutually exclusive
- build search context from persisted history using a small tail
heuristic: previous user message, assistant text between the last two
user turns capped at about 1k tokens, and current user message

## Test Plan

- `cargo test -p codex-web-search-extension`
- `cargo test -p codex-api`
- `cargo test -p codex-core
hosted_tools_follow_provider_auth_model_and_config_gates`

codex-rs/Cargo.lock

@@ -1859,6 +1859,7 @@ dependencies = [
  "pretty_assertions",
  "regex-lite",
  "reqwest",
+ "schemars 0.8.22",
  "serde",
  "serde_json",
  "tempfile",
@@ -1927,6 +1928,7 @@ dependencies = [
  "codex-utils-cli",
  "codex-utils-json-to-toml",
  "codex-utils-pty",
+ "codex-web-search-extension",
  "core_test_support",
  "flate2",
  "futures",
@@ -4117,6 +4119,26 @@ dependencies = [
  "v8",
 ]
 
+[[package]]
+name = "codex-web-search-extension"
+version = "0.0.0"
+dependencies = [
+ "async-trait",
+ "codex-api",
+ "codex-core",
+ "codex-extension-api",
+ "codex-features",
+ "codex-login",
+ "codex-model-provider",
+ "codex-model-provider-info",
+ "codex-protocol",
+ "codex-tools",
+ "http 1.4.0",
+ "pretty_assertions",
+ "schemars 0.8.22",
+ "serde_json",
+]
+
 [[package]]
 name = "codex-windows-sandbox"
 version = "0.0.0"