app-server: refresh live threads from latest config snapshot (#21187)

## Why

App-server config writes were leaving existing threads partially stale.
After a config mutation, the app-server told each live thread to run
`Op::ReloadUserConfig`, but that path only re-read the user
`config.toml` layer. Settings that came from the app-server's
materialized config snapshot did not propagate to existing threads until
restart.

This change prevent a FS access from `core` for CCA.

## What changed

- add `CodexThread::refresh_runtime_config()` and
`Session::refresh_runtime_config()` so the app-server can push a freshly
rebuilt config snapshot into a live thread
- rebuild the latest config with each thread's `cwd` after config
mutations, then refresh the thread from that snapshot instead of asking
it to reload only `config.toml`
- keep session-static settings unchanged during refresh, while updating
runtime-refreshable state such as the config layer stack,
`tool_suggest`, and derived hook/plugin/skill state
- keep `reload_user_config_layer()` as the file-backed fallback for
legacy local reload flows, but route the shared refresh logic through
the new runtime refresh path

## Testing

- add a session test that verifies `refresh_runtime_config()` rebuilds
hooks from refreshed config
- add a session test that verifies runtime-refreshable fields update
while session-static settings like `model` and `notify` stay unchanged

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/config/src/state.rs

@@ -237,28 +237,32 @@ impl ConfigLayerStack {
     /// replaced; otherwise, it is inserted into the stack at the appropriate
     /// position based on precedence rules.
     pub fn with_user_config(&self, config_toml: &AbsolutePathBuf, user_config: TomlValue) -> Self {
-        let user_layer = ConfigLayerEntry::new(
+        self.with_user_layer(Some(ConfigLayerEntry::new(
             ConfigLayerSource::User {
                 file: config_toml.clone(),
             },
             user_config,
-        );
+        )))
+    }
 
+    /// Returns a new stack with the user layer copied from `other`, preserving
+    /// every non-user layer already present in this stack.
+    pub fn with_user_layer_from(&self, other: &Self) -> Self {
+        self.with_user_layer(other.get_user_layer().cloned())
+    }
+
+    fn with_user_layer(&self, user_layer: Option<ConfigLayerEntry>) -> Self {
         let mut layers = self.layers.clone();
-        match self.user_layer_index {
-            Some(index) => {
+        let user_layer_index = match (self.user_layer_index, user_layer) {
+            (Some(index), Some(user_layer)) => {
                 layers[index] = user_layer;
-                Self {
-                    layers,
-                    user_layer_index: self.user_layer_index,
-                    requirements: self.requirements.clone(),
-                    requirements_toml: self.requirements_toml.clone(),
-                    ignore_user_and_project_exec_policy_rules: self
-                        .ignore_user_and_project_exec_policy_rules,
-                    startup_warnings: self.startup_warnings.clone(),
-                }
+                Some(index)
             }
-            None => {
+            (Some(index), None) => {
+                layers.remove(index);
+                None
+            }
+            (None, Some(user_layer)) => {
                 let user_layer_index = match layers
                     .iter()
                     .position(|layer| layer.name.precedence() > user_layer.name.precedence())
@@ -272,16 +276,18 @@ impl ConfigLayerStack {
                         layers.len() - 1
                     }
                 };
-                Self {
-                    layers,
-                    user_layer_index: Some(user_layer_index),
-                    requirements: self.requirements.clone(),
-                    requirements_toml: self.requirements_toml.clone(),
-                    ignore_user_and_project_exec_policy_rules: self
-                        .ignore_user_and_project_exec_policy_rules,
-                    startup_warnings: self.startup_warnings.clone(),
-                }
+                Some(user_layer_index)
             }
+            (None, None) => None,
+        };
+        Self {
+            layers,
+            user_layer_index,
+            requirements: self.requirements.clone(),
+            requirements_toml: self.requirements_toml.clone(),
+            ignore_user_and_project_exec_policy_rules: self
+                .ignore_user_and_project_exec_policy_rules,
+            startup_warnings: self.startup_warnings.clone(),
         }
     }