Load every project doc and confine its @imports to the project root

[thedancingdeveloper]

Summary

• project_doc_mode = "all" keeps every matching filename per directory instead of the first, then .claude/rules/*.md in sorted order, and expands line-only @path imports. Unset or anything else stays on the upstream first-match behaviour.
• Imports and rules are read through the executor filesystem and refused once they canonicalize outside the project root: absolute path, ~/, a .. climb and a symlink escape each have a test.
• The untrusted-project skip still runs before any of this is read.

Depends on #12 (WI-1131), whose three commits are in this branch. WI-1132. Do not merge; the epic lead reviews.

Test plan

• cargo test -p codex-core --offline --lib agents_md_compat — 3 passed (every doc plus sorted rules, in-project import expanded, the four escapes refused)
• cargo clippy -p codex-core --offline --lib -- -D warnings
• cargo test -p codex-core --offline --lib agents_md — the existing first-match suite, not yet rerun on this branch

[thedancingdeveloper]

Review: no blockers in WI-1132's own commits (head 2f98c50; reviewed 76658cb + 2f98c50 on top of #12's 93f35c0).

Security, checked against the requirements on WI-1132:

• Untrusted projects: load_project_instructions still returns early for an untrusted project (agents_md.rs:64), before any project_doc_all path.
• The root can't be widened by the repo: project_root merges markers only from layers above the project layer. With no marker it falls back to cwd, which is stricter.
• Imports: resolve_import refuses ~, absolute and scheme (:) references outright. Every doc, import and .claude/rules dir is canonicalized through the executor filesystem (so the sandbox applies) and must satisfy canonical.starts_with(root). PathUri::starts_with is segment-wise (native_path_segments_start_with), so /proj2 can't pass as /proj.
• Tests: a symlink escape, ../secret.md, /etc/hostname and ~/secret.md are all refused, and in-root imports are expanded.
• project_doc_mode defaults to first (upstream behaviour). all loads every matching file plus sorted .claude/rules.

Non-blocking: root isn't canonicalized before the comparison. If the project path itself goes through a symlink, legitimate docs will be refused, which fails closed but is still a functional bug. Canonicalize root once at the top.

Merge order: this PR carries #12's three commits, based on #12's older head 93f35c0. Merge #12 first, then rebase this onto fork/main so the PR shows only its two commits, and fork-ci green on that head. If the clippy gate flags upstream debt in agents_md.rs, the line-based gate follow-up (WI-1123) is the fix, not an edit here.

[thedancingdeveloper]

Review: no blockers in WI-1132's commits (head d8bcd12)

It's now stacked on #12's corrected head f9883a5, which is on fork/main feaf20e. Its own two commits (ccb7a04, d8bcd12) are identical (=) to the reviewed 76658cb and 2f98c50, so the security review stands. Merge #12 first. After that this PR shows only its two commits, and the merge condition is fork-ci green on the head at that point.

[thedancingdeveloper]

Review: no blockers (head 981a252)

This is a rebase onto fork/main ef97503, which includes #17's workspace bin build. git range-diff against the previously reviewed head shows every commit identical (=): its 2 commits on top of #12's 11aa919; merge after #12. Merge condition: fork-ci green on this head.

[thedancingdeveloper]

Superseded: these commits were cherry-picked into #22 (fork features, merged to fork/main as c2d74d2) and ship in release fork-c2d74d2d9. Closing so the work isn't merged twice. The branch is kept.