[WIP] Fix Codex using web search when tool is not provided

[Copilot]

Thanks for asking me to work on this. I will get started on it and keep this PR's description up to date as I form a plan and make progress.

---

This section details on the original issue you should resolve

<issue_title>Codex is able to use web search even when tool is not provided</issue_title>
<issue_description>Context: https://discord.com/channels/735557230698692749/1405934747690995732/1480304975857844318

A user created this workflow: https://github.com/drehelis/gcp-emulator-ui/blob/24120edf4d5213b87f31067920ea61bf32e18182/.github/workflows/check-emulator-updates.md?plain=1

Note that web-search is not included in the tools section.

In this run, you can see that Codex used web search:

🌐 Searched: site:github.com/drehelis/gcp-emulator-ui/issues "emulator release notes" "559.0.0"
2026-03-08T04:11:37.750396Z DEBUG codex_exec: Received event: Event { id: "019ccba4-8110-7d50-9428-7d3ac7ec34f7", msg: RawResponseItem(RawResponseItemEvent { item: WebSearchCall { id: Some("ws_09eaaf924a0151210169acf6f7b030819da91c012df596f950"), status: Some("completed"), action: Some(Search { query: Some("site:github.com/drehelis/gcp-emulator-ui/issues \"emulator release notes\" \"559.0.0\""), queries: Some(["site:github.com/drehelis/gcp-emulator-ui/issues \"emulator release notes\" \"559.0.0\""]) }) } }) }

It seems like we should disable web search in Codex by default, and only enable it if the web-search tool is passed. Here are Codex docs on how to disable web search: https://developers.openai.com/codex/cli/features/#web-search

</issue_description>

Comments on the Issue (you are @copilot in this section)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.