[codex] Support SQLite-disabled degraded mode

[jgershen-oai]

Summary

• Restore [features] sqlite = false as a supported escape hatch for environments where the local state database cannot be used safely, such as a Codex home on NFS.
• Skip state-database initialization, recovery, and doctor integrity/parity checks when SQLite is disabled, and avoid reusing an implicit local daemon that cannot inherit the invocation's effective feature set.
• Disable SQLite-dependent features (goals and spawn_csv) and return explicit degraded-mode responses for database-only operations. Import-history reads return an empty list when no state DB exists.
• Emit a startup configuration warning when the effective configuration disables SQLite.
• Disable SQLite in the non-strict invalid-config fallback so startup does not silently open a database after rejecting the user's configuration.

Root cause and impact

The sqlite feature was marked as removed, so sqlite = false was no longer an effective opt-out even though newer startup and request paths initialize and depend on the state DB. Users whose Codex state lives on filesystems with unreliable SQLite locking could therefore no longer prevent Codex from opening the database.

This change makes the flag stable and configurable again while preserving the existing default of true. It does not make SQLite safe over NFS; it provides an intentional degraded mode. In that mode, SQLite-dependent features and operations are unavailable. Explicit remote app-server targets are unchanged; only implicit local-daemon reuse falls back to the embedded server.

Test plan

• Added feature-normalization coverage for SQLite-dependent features.
• Added core, TUI, CLI, and app-server coverage verifying disabled mode does not create or mutate runtime databases.
• Added API coverage for memory reset, thread metadata updates, relationship filters, and import-history reads in disabled mode.
• Added initialization coverage for the SQLite-disabled degraded-mode warning.
• Verified existing enabled-mode memory clearing still works.
• Ran:
  • cargo check -p codex-cli -p codex-app-server
  • cargo test -p codex-cli --bin codex clear_memories_rejects_disabled_sqlite_without_mutating_state
  • cargo test -p codex-cli --test debug_clear_memories
  • cargo test -p codex-app-server --test all sqlite_disabled
  • cargo test -p codex-app-server --test all non_strict_config_fallback_disables_sqlite
  • cargo test -p codex-app-server --test all external_agent_config_import_histories_are_empty_when_sqlite_is_disabled
  • cargo fmt --all -- --check