[codex] Enable standalone web search in code mode (#26719)

## What

- Consume plaintext `output` from standalone search while retaining
optional `encrypted_output` parsing.
- Expose `web.run` to code mode and return search output to nested
JavaScript calls.
- Cover direct and code-mode standalone search paths with integration
tests.

## Why

`/v1/alpha/search` now returns plaintext output, which code mode needs
to consume standalone search results.

## Test plan

- `just test -p codex-api`
- `just test -p codex-web-search-extension`
- `just test -p codex-core code_mode_can_call_standalone_web_search`
- `just test -p codex-app-server
standalone_web_search_round_trips_output`

codex-rs/codex-api/src/endpoint/search.rs

@@ -134,10 +134,13 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn search_posts_typed_request_and_parses_encrypted_output() {
+    async fn search_posts_typed_request_and_parses_output() {
         let transport = CapturingTransport::new(
-            serde_json::to_vec(&json!({"encrypted_output": "ciphertext"}))
-                .expect("serialize response"),
+            serde_json::to_vec(&json!({
+                "encrypted_output": "ciphertext",
+                "output": "search result",
+            }))
+            .expect("serialize response"),
         );
         let client = SearchClient::new(transport.clone(), provider(), Arc::new(DummyAuth));
 
@@ -203,7 +206,8 @@ mod tests {
         assert_eq!(
             response,
             SearchResponse {
-                encrypted_output: "ciphertext".to_string(),
+                encrypted_output: Some("ciphertext".to_string()),
+                output: "search result".to_string(),
             }
         );
 

codex-rs/codex-api/src/search.rs

@@ -280,5 +280,6 @@ pub enum AllowedCaller {
 
 #[derive(Debug, Clone, Deserialize, PartialEq, Eq)]
 pub struct SearchResponse {
-    pub encrypted_output: String,
+    pub encrypted_output: Option<String>,
+    pub output: String,
 }