Make request_user_input timeout duration and timeout behavior configurable

Start by locating the request_user_input timeout implementation and the configuration parsing path. Trace how the behavior is shared across the CLI/TUI and IDE extension, then verify that defaults remain unchanged, disabling timeouts blocks indefinitely, and each requested on-timeout action works consistently.

What variant of Codex are you using?

CLI

What feature would you like to see?

Is your feature request related to a problem?
Codex currently auto-resolves request_user_input prompts after a fixed timer (60s grace + 60s countdown), then submits an empty answer on timeout (introduced in #28235). Related discussions #27458 and #28969 mostly focus on disabling this or lengthening the duration.
Beyond just disabling it, there's a distinct gap: when a timeout does fire, the action taken is hardcoded to "submit empty answer." For unattended / semi-attended workflows, a hardcoded empty answer is often the worst choice — the recommended/first option would be far more useful.

Describe the solution you'd like
A config block that exposes both the duration and the on-timeout behavior, e.g. under ~/.codex/config.toml:

[tools.request_user_input]
# Master switch — false disables auto-resolution entirely (covers #28969)
timeout_enabled = true

# How long to wait before auto-resolving (covers duration part of #27458)
timeout_ms = 120000

# What to do when the timeout fires. This is the new dimension:
#   "empty_answer"    -> current behavior: submit an empty response
#   "first_option"    -> select the first / recommended option
#   "cancel"          -> abort the tool call and let the model proceed without an answer
on_timeout = "first_option"

Requirements:

• Defaults preserve current behavior (on_timeout = "empty_answer", current durations) so nothing breaks.
• Setting timeout_enabled = false makes questions block indefinitely.
  Applies consistently across CLI/TUI and the IDE extension.

Describe alternatives you've considered

• Raising model_providers..stream_idle_timeout_ms — too broad, affects unrelated stream-idle behavior and requires shadowing the built-in openai provider.
• Instructing Codex via AGENTS.md to not auto-timeout — unreliable per user reports in #27458.

Additional information

Extends #27458 and #28969. Those cover disabling / duration; this one adds the configurable on-timeout action (first_option vs empty_answer vs cancel), which none of them specify.