feat: add web-fetch MCP server for Codex engine

[Copilot]

Smoke-codex runs were failing because the model reported "web-fetch MCP tool was not exposed in this session." Unlike Claude/Copilot/Gemini which expose web-fetch as a native built-in, Codex has no discoverable MCP tool by that name — the -c fetch config flag does not surface as a callable MCP tool.

Changes

• web_fetch_server.cjs — new minimal Node.js MCP stdio server providing a fetch tool. Runs in a node:lts-alpine container with --network host. Includes SSRF guards (http/https-only protocol validation, redirect URL validation), a bounded redirect counter (max 5), and a 10 MiB response size cap.

• mcp_setup_generator.go — collectMCPTools now accepts the engine ID; injects "web-fetch" into mcpTools only for Codex. Other engines are unaffected.

• mcp_renderer_builtin.go — adds RenderWebFetchMCP (dispatches to TOML or JSON), renderWebFetchTOML, and renderWebFetchMCPConfigWithOptions. The generated gateway JSON entry:

  "web-fetch": {
    "container": "node:lts-alpine",
    "entrypoint": "node",
    "entrypointArgs": ["${RUNNER_TEMP}/gh-aw/actions/web_fetch_server.cjs"],
    "mounts": ["${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro"],
    "args": ["--init", "--network", "host"]
  }

  After the gateway starts the container, convert_gateway_config_codex.cjs converts it to an HTTP URL entry in the final Codex config.toml.

• mcp_renderer.go / mcp_renderer_types.go / mcp_rendering.go — adds RenderWebFetch field to MCPToolRenderers and wires it through buildStandardJSONMCPRenderers; nil-safe so non-Codex engines silently skip it.

• codex_mcp.go — adds case "web-fetch" in the Codex TOML switch.

• job_constants.go — adds WebFetchMCPServerID = "web-fetch" constant.

• Tests — TestCodexWebFetchMCPServer asserts the server appears in compiled Codex output; TestNonCodexEnginesDoNotGetWebFetchMCPServer asserts Claude and Copilot do not include it.