Represent dynamic tools with explicit namespaces internally (#27365)

Follow-up to #27356.

## Stack note

This PR changes Codex's internal dynamic-tool shape while leaving
`thread/start` unchanged. App-server therefore converts the existing
per-tool input into explicit functions and namespaces before passing it
to core.

[#27371](https://github.com/openai/codex/pull/27371) updates
`thread/start` to use the same explicit shape and removes this temporary
conversion.

## Why

Dynamic tools repeat namespace metadata on every function. Core should
keep one explicit namespace with its member tools so descriptions and
membership stay consistent across sessions and runtime planning.

## What changed

- Represent dynamic tools as top-level functions or explicit namespaces
in protocol and session state.
- Read old flat rollout metadata and write the canonical hierarchy.
- Flatten namespace members only when registering callable tools.
- Keep `thread/start.dynamicTools` flat for now and normalize it at the
app-server boundary.

New builds can read old rollout metadata. Older builds cannot read newly
written hierarchical metadata.

## Test plan

- `just test -p codex-app-server
thread_start_normalizes_legacy_dynamic_tools_into_model_request`
- `just test -p codex-protocol
session_meta_normalizes_legacy_dynamic_tools`
- `just test -p codex-core
resume_restores_dynamic_tools_from_rollout_with_sqlite_enabled`
- `just test -p codex-core
tool_search_returns_deferred_dynamic_tool_and_routes_follow_up_call`
- `just test -p codex-core code_mode_can_call_hidden_dynamic_tools`
- `just test -p codex-tools`

codex-rs/tools/src/code_mode.rs

@@ -63,7 +63,19 @@ pub fn collect_code_mode_tool_definitions<'a>(
 ) -> Vec<CodeModeToolDefinition> {
     let mut tool_definitions = specs
         .into_iter()
-        .flat_map(code_mode_tool_definitions_for_spec)
+        .flat_map(|spec| {
+            let mut definitions = code_mode_tool_definitions_for_spec(spec);
+            if let ToolSpec::Namespace(namespace) = spec {
+                let namespace_description = namespace.description.trim();
+                if !namespace_description.is_empty() {
+                    for definition in &mut definitions {
+                        definition.description =
+                            format!("{namespace_description}\n\n{}", definition.description);
+                    }
+                }
+            }
+            definitions
+        })
         .filter(|definition| codex_code_mode::is_code_mode_nested_tool(&definition.name))
         .map(codex_code_mode::augment_tool_definition)
         .collect::<Vec<_>>();

codex-rs/tools/src/dynamic_tool.rs

@@ -1,8 +1,10 @@
 use crate::ToolDefinition;
 use crate::parse_tool_input_schema;
-use codex_protocol::dynamic_tools::DynamicToolSpec;
+use codex_protocol::dynamic_tools::DynamicToolFunctionSpec;
 
-pub fn parse_dynamic_tool(tool: &DynamicToolSpec) -> Result<ToolDefinition, serde_json::Error> {
+pub fn parse_dynamic_tool(
+    tool: &DynamicToolFunctionSpec,
+) -> Result<ToolDefinition, serde_json::Error> {
     Ok(ToolDefinition {
         name: tool.name.clone(),
         description: tool.description.clone(),

codex-rs/tools/src/dynamic_tool_tests.rs

@@ -1,14 +1,13 @@
 use super::parse_dynamic_tool;
 use crate::JsonSchema;
 use crate::ToolDefinition;
-use codex_protocol::dynamic_tools::DynamicToolSpec;
+use codex_protocol::dynamic_tools::DynamicToolFunctionSpec;
 use pretty_assertions::assert_eq;
 use std::collections::BTreeMap;
 
 #[test]
 fn parse_dynamic_tool_sanitizes_input_schema() {
-    let tool = DynamicToolSpec {
-        namespace: None,
+    let tool = DynamicToolFunctionSpec {
         name: "lookup_ticket".to_string(),
         description: "Fetch a ticket".to_string(),
         input_schema: serde_json::json!({
@@ -39,8 +38,7 @@ fn parse_dynamic_tool_sanitizes_input_schema() {
 
 #[test]
 fn parse_dynamic_tool_preserves_defer_loading() {
-    let tool = DynamicToolSpec {
-        namespace: None,
+    let tool = DynamicToolFunctionSpec {
         name: "lookup_ticket".to_string(),
         description: "Fetch a ticket".to_string(),
         input_schema: serde_json::json!({

codex-rs/tools/src/responses_api.rs

@@ -3,7 +3,7 @@ use crate::ToolDefinition;
 use crate::ToolName;
 use crate::parse_dynamic_tool;
 use crate::parse_mcp_tool;
-use codex_protocol::dynamic_tools::DynamicToolSpec;
+use codex_protocol::dynamic_tools::DynamicToolFunctionSpec;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json::Value;
@@ -67,7 +67,7 @@ pub enum ResponsesApiNamespaceTool {
 }
 
 pub fn dynamic_tool_to_responses_api_tool(
-    tool: &DynamicToolSpec,
+    tool: &DynamicToolFunctionSpec,
 ) -> Result<ResponsesApiTool, serde_json::Error> {
     Ok(tool_definition_to_responses_api_tool(parse_dynamic_tool(
         tool,

codex-rs/tools/src/responses_api_tests.rs

@@ -8,7 +8,7 @@ use super::tool_definition_to_responses_api_tool;
 use crate::JsonSchema;
 use crate::ToolDefinition;
 use crate::ToolName;
-use codex_protocol::dynamic_tools::DynamicToolSpec;
+use codex_protocol::dynamic_tools::DynamicToolFunctionSpec;
 use pretty_assertions::assert_eq;
 use serde_json::json;
 use std::collections::BTreeMap;
@@ -50,8 +50,7 @@ fn tool_definition_to_responses_api_tool_omits_false_defer_loading() {
 
 #[test]
 fn dynamic_tool_to_responses_api_tool_preserves_defer_loading() {
-    let tool = DynamicToolSpec {
-        namespace: None,
+    let tool = DynamicToolFunctionSpec {
         name: "lookup_order".to_string(),
         description: "Look up an order".to_string(),
         input_schema: json!({