Remove skills list extra roots

[xli-oai]

Summary

• Remove perCwdExtraUserRoots / SkillsListExtraRootsForCwd from the skills/list app-server API.
• Drop Rust app-server and codex-core-skills extra-root plumbing so skill scans are keyed by the normal cwd/user/plugin roots only.
• Regenerate app-server schemas and update docs/tests that only existed for the removed extra-roots behavior.

Validation

• just write-app-server-schema
• just fmt
• cargo test -p codex-app-server-protocol
• cargo test -p codex-core-skills
• just fix -p codex-app-server-protocol
• just fix -p codex-core-skills
• just fix -p codex-app-server
• just fix -p codex-tui

Notes

• cargo test -p codex-app-server --test all skills_list ran the edited skills-list cases, but the full filtered run ended on existing skills_changed_notification_is_emitted_after_skill_change timeout after a websocket 401.
• cargo test -p codex-tui --lib compiled the changed TUI callers, then failed two unrelated status permission tests because local /etc/codex/requirements.toml forbids DangerFullAccess.
• Source-truth check found the OpenAI monorepo still has generated/app-server-kit mirror references to the removed field; those should be cleaned up when generated app-server types are synced or in a companion OpenAI cleanup.

[xli-oai]

@codex review