fix(ai): admit direct GPT-5.6 dynamic tools

[first-assist]

Outcome

• omit only the process-level --disable code_mode_host flag from the closed Codex dynamic-tool launch profile
• retain features.code_mode_host=false, features.code_mode=false, features.code_mode_only=false, and every native-surface disable per thread
• reject command, file, MCP, collaboration, web-search, and image items at both lifecycle boundaries on retained dynamic turns
• record the measured Codex 0.148.0 / GPT-5.6 Luna flag dependence and bump graphql-orm-ai to 0.88.0

Security boundary

This does not enable Code Mode, shell, files, MCP, browser, hosted web search, collaboration, images, or arbitrary JSON-RPC. The process sandbox remains closed, and any native item still poisons the turn. The one omitted process flag is required for Codex 0.148.0 to deliver the already-reviewed direct dynamicToolCall; the per-thread feature remains false.

Verification

• cargo check -p graphql-orm-ai --features provider-codex-app-server
• focused launch-profile and native-item lifecycle tests: pass
• full cargo test -p graphql-orm-ai --features provider-codex-app-server: 313 passed, 2 expected installed-Codex tests ignored; all integration lanes pass
• generated inventory, documentation validation, formatting and diff checks: pass
• release-policy check against origin/main: pass

Warnings-denied all-target Clippy is currently blocked by two pre-existing findings outside this diff: graphql-orm-macros/src/operations.rs:4870 (collapsible_else_if) and graphql-orm-ai/src/providers/codex_app_server.rs:6604 (find(...).is_none()) in an existing test. No branch code triggers either finding.

Documentation / migration

• Documentation updated
• No documentation impact

README, provider-session guide, changelog, migration guide, Cargo.lock, and generated workspace inventory are updated. Schema module 0.63.0 is unchanged; no data, GraphQL SDL, protected-payload, backup, or restore migration is required.