Apply argument comment lint across codex-rs (#14652)

## Why

Once the repo-local lint exists, `codex-rs` needs to follow the
checked-in convention and CI needs to keep it from drifting. This commit
applies the fallback `/*param*/` style consistently across existing
positional literal call sites without changing those APIs.

The longer-term preference is still to avoid APIs that require comments
by choosing clearer parameter types and call shapes. This PR is
intentionally the mechanical follow-through for the places where the
existing signatures stay in place.

After rebasing onto newer `main`, the rollout also had to cover newly
introduced `tui_app_server` call sites. That made it clear the first cut
of the CI job was too expensive for the common path: it was spending
almost as much time installing `cargo-dylint` and re-testing the lint
crate as a representative test job spends running product tests. The CI
update keeps the full workspace enforcement but trims that extra
overhead from ordinary `codex-rs` PRs.

## What changed

- keep a dedicated `argument_comment_lint` job in `rust-ci`
- mechanically annotate remaining opaque positional literals across
`codex-rs` with exact `/*param*/` comments, including the rebased
`tui_app_server` call sites that now fall under the lint
- keep the checked-in style aligned with the lint policy by using
`/*param*/` and leaving string and char literals uncommented
- cache `cargo-dylint`, `dylint-link`, and the relevant Cargo
registry/git metadata in the lint job
- split changed-path detection so the lint crate's own `cargo test` step
runs only when `tools/argument-comment-lint/*` or `rust-ci.yml` changes
- continue to run the repo wrapper over the `codex-rs` workspace, so
product-code enforcement is unchanged

Most of the code changes in this commit are intentionally mechanical
comment rewrites or insertions driven by the lint itself.

## Verification

- `./tools/argument-comment-lint/run.sh --workspace`
- `cargo test -p codex-tui-app-server -p codex-tui`
- parsed `.github/workflows/rust-ci.yml` locally with PyYAML

---

* -> #14652
* #14651

codex-rs/core/src/config/agent_roles.rs

@@ -19,8 +19,10 @@ pub(crate) fn load_agent_roles(
     config_layer_stack: &ConfigLayerStack,
     startup_warnings: &mut Vec<String>,
 ) -> std::io::Result<BTreeMap<String, AgentRoleConfig>> {
-    let layers =
-        config_layer_stack.get_layers(ConfigLayerStackOrdering::LowestPrecedenceFirst, false);
+    let layers = config_layer_stack.get_layers(
+        ConfigLayerStackOrdering::LowestPrecedenceFirst,
+        /*include_disabled*/ false,
+    );
     if layers.is_empty() {
         return load_agent_roles_without_layers(cfg);
     }
@@ -450,13 +452,14 @@ fn discover_agent_roles_in_dir(
         if declared_role_files.contains(&agent_file) {
             continue;
         }
-        let parsed_file = match read_resolved_agent_role_file(&agent_file, None) {
-            Ok(parsed_file) => parsed_file,
-            Err(err) => {
-                push_agent_role_warning(startup_warnings, err);
-                continue;
-            }
-        };
+        let parsed_file =
+            match read_resolved_agent_role_file(&agent_file, /*role_name_hint*/ None) {
+                Ok(parsed_file) => parsed_file,
+                Err(err) => {
+                    push_agent_role_warning(startup_warnings, err);
+                    continue;
+                }
+            };
         let role_name = parsed_file.role_name;
         if roles.contains_key(&role_name) {
             push_agent_role_warning(

codex-rs/core/src/config/managed_features.rs

@@ -81,11 +81,11 @@ impl ManagedFeatures {
     }
 
     pub fn enable(&mut self, feature: Feature) -> ConstraintResult<()> {
-        self.set_enabled(feature, true)
+        self.set_enabled(feature, /*enabled*/ true)
     }
 
     pub fn disable(&mut self, feature: Feature) -> ConstraintResult<()> {
-        self.set_enabled(feature, false)
+        self.set_enabled(feature, /*enabled*/ false)
     }
 }
 
@@ -321,7 +321,12 @@ pub(crate) fn validate_feature_requirements_in_config_toml(
             })
     }
 
-    validate_profile(cfg, None, &ConfigProfile::default(), feature_requirements)?;
+    validate_profile(
+        cfg,
+        /*profile_name*/ None,
+        &ConfigProfile::default(),
+        feature_requirements,
+    )?;
     for (profile_name, profile) in &cfg.profiles {
         validate_profile(cfg, Some(profile_name), profile, feature_requirements)?;
     }

codex-rs/core/src/config/mod.rs

@@ -1831,9 +1831,10 @@ fn resolve_permission_config_syntax(
     }
 
     let mut selection = None;
-    for layer in
-        config_layer_stack.get_layers(ConfigLayerStackOrdering::LowestPrecedenceFirst, false)
-    {
+    for layer in config_layer_stack.get_layers(
+        ConfigLayerStackOrdering::LowestPrecedenceFirst,
+        /*include_disabled*/ false,
+    ) {
         let Ok(layer_selection) = layer.config.clone().try_into::<PermissionSelectionToml>() else {
             continue;
         };

codex-rs/core/src/config/network_proxy_spec.rs

@@ -77,7 +77,7 @@ impl NetworkProxySpec {
     }
 
     pub fn proxy_host_and_port(&self) -> String {
-        host_and_port_from_network_addr(&self.config.network.proxy_url, 3128)
+        host_and_port_from_network_addr(&self.config.network.proxy_url, /*default_port*/ 3128)
     }
 
     pub fn socks_enabled(&self) -> bool {

codex-rs/core/src/config/permissions.rs

@@ -281,9 +281,11 @@ fn parse_special_path(path: &str) -> Option<FileSystemSpecialPath> {
     match path {
         ":root" => Some(FileSystemSpecialPath::Root),
         ":minimal" => Some(FileSystemSpecialPath::Minimal),
-        ":project_roots" => Some(FileSystemSpecialPath::project_roots(None)),
+        ":project_roots" => Some(FileSystemSpecialPath::project_roots(/*subpath*/ None)),
         ":tmpdir" => Some(FileSystemSpecialPath::Tmpdir),
-        _ if path.starts_with(':') => Some(FileSystemSpecialPath::unknown(path, None)),
+        _ if path.starts_with(':') => {
+            Some(FileSystemSpecialPath::unknown(path, /*subpath*/ None))
+        }
         _ => None,
     }
 }

codex-rs/core/src/config/service.rs

@@ -183,7 +183,10 @@ impl ConfigService {
             origins: layers.origins(),
             layers: params.include_layers.then(|| {
                 layers
-                    .get_layers(ConfigLayerStackOrdering::HighestPrecedenceFirst, true)
+                    .get_layers(
+                        ConfigLayerStackOrdering::HighestPrecedenceFirst,
+                        /*include_disabled*/ true,
+                    )
                     .iter()
                     .map(|layer| layer.as_layer())
                     .collect()