[codex] Hide deferred tools from code mode prompt

[pakrym-oai]

Why

code_mode_only_guides_all_tools_search_and_calls_deferred_app_tools was failing because code-mode prompt generation used the same nested tool spec list for both the model-visible exec guide and the runtime ALL_TOOLS surface. That allowed deferred MCP/app tools, such as calendar_timezone_option_99, to leak into the exec description even though they should only be discoverable through ALL_TOOLS at runtime.

What changed

Split code-mode nested tool planning into two sets in core/src/tools/spec_plan.rs:

• runtime nested tool specs still include deferred tools, so tools[...] and ALL_TOOLS can call them
• exec prompt docs only render non-deferred tools, so deferred app tools stay out of the model-visible guide

Validation

• cargo test -p codex-core --test all code_mode_only_guides_all_tools_search_and_calls_deferred_app_tools -- --nocapture
• looped the same focused test 5 additional times with cargo test -q -p codex-core --test all code_mode_only_guides_all_tools_search_and_calls_deferred_app_tools

[pakrym-oai]

#23605