Route AGENTS.md loading through environment filesystems (#26205)

## Why

Workspace-specific `AGENTS.md` loading needs to use the selected
environment filesystem so remote workspaces and child agents read
instructions from their actual environment instead of the host
filesystem. The app-server should report the same instruction sources
the initialized thread actually loaded, rather than independently
rescanning configuration and filesystem state.

## What changed

- Introduce `LoadedAgentsMd` to retain ordered user, project, and
internal instructions with their provenance.
- Load and canonicalize workspace `AGENTS.md` paths through the primary
`EnvironmentManager` environment, then render the loaded instructions
when constructing turn context.
- Expose cached loaded instruction sources from initialized threads and
use them for app-server start, resume, and fork responses.
- Preserve global `CODEX_HOME` loading and separator behavior while
excluding empty project files that did not supply model-visible
instructions.
- Add integration coverage for CLI injection, selected-environment
provenance and rendering, empty environment selection, and cached
sources on loaded-thread resume.

## Validation

- `just test -p codex-core agents_md`
- `just test -p codex-core
selected_environment_sources_match_model_visible_instructions`
- `just test -p codex-exec agents_md`
- `just test -p codex-app-server instruction_sources`
- `just test -p codex-app-server --status-level fail`

codex-rs/exec/tests/suite/agents_md.rs

@@ -0,0 +1,74 @@
+#![allow(clippy::expect_used, clippy::unwrap_used)]
+
+use core_test_support::responses;
+use core_test_support::test_codex_exec::test_codex_exec;
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn exec_includes_workspace_agents_md_in_request() -> anyhow::Result<()> {
+    let test = test_codex_exec();
+    std::fs::write(test.cwd_path().join("AGENTS.md"), "workspace instructions")?;
+
+    let server = responses::start_mock_server().await;
+    let body = responses::sse(vec![
+        responses::ev_response_created("resp1"),
+        responses::ev_assistant_message("m1", "fixture hello"),
+        responses::ev_completed("resp1"),
+    ]);
+    let response_mock = responses::mount_sse_once(&server, body).await;
+
+    test.cmd_with_server(&server)
+        .arg("--skip-git-repo-check")
+        .arg("tell me something")
+        .assert()
+        .success();
+
+    let user_messages = response_mock.single_request().message_input_texts("user");
+    assert!(
+        user_messages
+            .iter()
+            .any(|text| text.contains("workspace instructions")),
+        "request should include workspace AGENTS.md instructions: {user_messages:?}"
+    );
+
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn exec_prefers_workspace_agents_override_md() -> anyhow::Result<()> {
+    let test = test_codex_exec();
+    std::fs::write(test.cwd_path().join("AGENTS.md"), "base instructions")?;
+    std::fs::write(
+        test.cwd_path().join("AGENTS.override.md"),
+        "override instructions",
+    )?;
+
+    let server = responses::start_mock_server().await;
+    let body = responses::sse(vec![
+        responses::ev_response_created("resp1"),
+        responses::ev_assistant_message("m1", "fixture hello"),
+        responses::ev_completed("resp1"),
+    ]);
+    let response_mock = responses::mount_sse_once(&server, body).await;
+
+    test.cmd_with_server(&server)
+        .arg("--skip-git-repo-check")
+        .arg("tell me something")
+        .assert()
+        .success();
+
+    let user_messages = response_mock.single_request().message_input_texts("user");
+    assert!(
+        user_messages
+            .iter()
+            .any(|text| text.contains("override instructions")),
+        "request should include AGENTS.override.md instructions: {user_messages:?}"
+    );
+    assert!(
+        user_messages
+            .iter()
+            .all(|text| !text.contains("base instructions")),
+        "request should exclude shadowed AGENTS.md instructions: {user_messages:?}"
+    );
+
+    Ok(())
+}

codex-rs/exec/tests/suite/mod.rs

@@ -1,5 +1,6 @@
 // Aggregates all former standalone integration tests as modules.
 mod add_dir;
+mod agents_md;
 mod apply_patch;
 mod approval_policy;
 mod auth_env;