[app-server] Add lossless in-process event delivery

[adamvy-oai]

Overview

This is the second change in a five-PR stack that improves the Rust embedding API for codex-app-server. It builds on the explicit start options from the first PR by making event-delivery guarantees and shutdown sequencing configurable.

What

• add InProcessEventDelivery::{BestEffort, Lossless}
• retain best-effort delivery as the default
• allow lossless consumers to apply backpressure instead of dropping events when the channel is full
• add opaque InProcessShutdown, begin_shutdown(), and finish_shutdown() APIs
• close client-message intake during shutdown and drain requests accepted before the close
• continue routing queued processor and outbound-writer messages while shutdown completes

Why

Best-effort delivery is appropriate for existing callers that must not block on a slow event consumer. Some embedders instead need every ordered event and are prepared to apply backpressure. Making that choice explicit avoids silently changing current callers.

Lossless delivery also requires a drainable shutdown sequence. begin_shutdown() closes client-message intake, drains requests that the runtime already accepted, and lets callers drain the event stream until it closes. finish_shutdown() then joins the runtime after delivery is complete.

Stack

Each PR is based on the preceding branch:

1. #28459 — custom in-process thread stores
2. #28460 — lossless in-process event delivery (this PR)
3. #28461 — stored-thread view helpers
4. #28462 — rollout-history turn boundaries
5. #30369 — durable external thread goals

Validation

Validation for the final stacked commits:

• eight focused in-process app-server tests, including capacity-one saturation, ordered event draining, and requests accepted immediately before shutdown
• just test -p codex-app-server: 886 passed; one timing retry passed on its second attempt
• just test -p codex-core: 2,717 passed; eight timing-sensitive failures passed in focused reruns, while five high-output code-mode failures remained
• just test --test-threads=8: 10,944 of 10,958 passed; the remaining failures were the same five high-output tests, three timing-sensitive tests that pass in focused reruns, and six tests in untouched exec/TUI code affected by this host's managed permission policy
• a representative high-output failure reproduces on the exact upstream/main commit
• just fix -p codex-app-server, just fix -p codex-core, and just fmt; final worktree clean

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}