[app-server] Allow custom in-process thread stores

[adamvy-oai]

Overview

This is the first change in a five-PR stack that makes codex-app-server easier to embed as a Rust library. The stack adds explicit, opt-in host configuration for persistence and event delivery, then extracts reusable helpers for stored-thread views and rollout-history classification before adding durable external thread goals. Existing startup behavior remains the default, and the stack does not change app-server wire methods or schemas.

What

• add a private-field InProcessStartOptions type
• add with_thread_store() for supplying a ThreadStore
• add start_with_options() for starting the in-process app server with those options
• keep start() as the compatibility entry point with the existing default store and behavior

Why

The in-process entry point previously selected its thread store internally. A program embedding codex-app-server therefore could not provide another persistence implementation without reproducing app-server startup code. This change makes the store an explicit opt-in dependency while preserving the existing path for all current callers.

Private fields and builder methods keep construction controlled and allow later options without requiring callers to initialize every field.

Stack

Each PR is based on the preceding branch:

1. #28459 — custom in-process thread stores (this PR)
2. #28460 — lossless in-process event delivery
3. #28461 — stored-thread view helpers
4. #28462 — rollout-history turn boundaries
5. #30369 — durable external thread goals

Validation

Validation for the final stacked commits:

• focused in-process startup tests covering default and injected-store paths
• just test -p codex-app-server: 886 passed; one timing retry passed on its second attempt
• just test -p codex-core: 2,717 passed; eight timing-sensitive failures passed in focused reruns, while five high-output code-mode failures remained
• just test --test-threads=8: 10,944 of 10,958 passed; the remaining failures were the same five high-output tests, three timing-sensitive tests that pass in focused reruns, and six tests in untouched exec/TUI code affected by this host's managed permission policy
• a representative high-output failure reproduces on the exact upstream/main commit
• just fix -p codex-app-server, just fix -p codex-core, and just fmt; final worktree clean

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[adamvy-oai]

I have read the CLA Document and I hereby sign the CLA