Support multiple forced ChatGPT workspace ids in config and requirements

[rreichel3-oai]

Summary

• allow forced_chatgpt_workspace_id to be configured as either a single string or an array of workspace IDs
• support the same shape in both config.toml and managed requirements.toml / cloud requirements
• prefer the requirements value over ordinary config when both are present, because requirements are managed policy
• normalize and enforce the workspace allowlist across ChatGPT login, device-code login, external auth refresh, app-server, CLI, and TUI paths
• regenerate config/app-server schemas and document the single-value and array config forms

Example

Single workspace remains supported in either config.toml or requirements.toml:

forced_chatgpt_workspace_id = "workspace_id"

Multiple allowed workspaces can now be configured with an array:

forced_chatgpt_workspace_id = ["workspace_id_a", "workspace_id_b"]

If both files specify forced_chatgpt_workspace_id, the value from requirements.toml wins. Codex trims whitespace and ignores empty string entries; an explicitly empty list remains an active allowlist and permits no ChatGPT workspace.

Testing

• just fmt
• just write-config-schema
• just write-app-server-schema
• cargo test -p codex-core forced_chatgpt_workspace_id_accepts_string_and_list
• cargo test -p codex-login workspace
• cargo test -p codex-app-server-protocol
• cargo test -p codex-protocol
• cargo test -p codex-app-server external_auth_refresh_mismatched_workspace_fails_turn
• cargo test -p codex-tui local_chatgpt_auth
• just fix -p codex-protocol -p codex-config -p codex-core -p codex-login -p codex-app-server-protocol -p codex-app-server -p codex-cli -p codex-tui
• cargo test -p codex-config forced_chatgpt_workspace_id
• cargo test -p codex-core forced_chatgpt_workspace_id
• cargo test -p codex-app-server map_requirements_toml_to_api
• cargo test -p codex-cloud-requirements
• cargo test -p codex-core legacy_managed_config_backfill
• cargo test -p codex-core load_config_layers_includes_cloud_requirements
• cargo test -p codex-tui debug_config
• just fix -p codex-protocol -p codex-config -p codex-core -p codex-cloud-requirements -p codex-app-server-protocol -p codex-app-server -p codex-tui
• final just fmt
• git diff --check

Did not run the full workspace cargo test; repo guidance asks for confirmation before running the complete suite after core/protocol changes.