[4/5] [config] Activate generic managed-layer precedence

[hefuc-oai]

Summary

• materialize managed baseline and systemOverlay buckets at their generic config and requirements precedence points
• prefer a present system overlay, including an explicitly empty one, and retain enterpriseManaged only as the old-backend fallback
• require the full-payload cache signature on every cache read so legacy cache entries miss and refetch
• expose generic cloudManaged source attribution through app-server v2, generated schemas/TypeScript, diagnostics, hooks, and /debug-config

This PR intentionally contains no parental-control, RBAC, or rollout-source behavior. Those sources use the generic delivery contract outside Rust.

Compatibility

• old backend responses continue through the legacy enterprise fallback
• new responses apply each managed fragment exactly once
• an explicitly empty system overlay suppresses legacy fallback
• org-only cloud-bundle eligibility is unchanged

Validation

• just test -p codex-config -p codex-cloud-config -p codex-app-server-protocol -p codex-hooks (578 passed)
• focused codex-core precedence and explicit-empty fallback tests
• focused codex-tui debug-config snapshot test
• cargo check across config, cloud-config, hooks, TUI, app-server, and core
• just write-app-server-schema
• scoped just fix for all touched crates
• just fmt

A broader 7,223-test scoped run reached all selected tests but reported unrelated environment failures in sandbox/PTY/MCP paths because this container has no bwrap; the directly affected library suites above are clean. codex-core-skills likewise passed 104/106 tests, with two pre-existing parent-discovery assertions affected by /tmp/.codex in the host environment.

Stacked on #28965.