feat: support Codex ChatGPT OAuth auth

[eddie333016]

Summary

• Add first-class Codex ChatGPT OAuth auth-file discovery and isolated child authentication.
• Verify provider-signed OAuth JWT rotations while refusing to persist unverified opaque access or refresh replacements.
• Keep OAuth separate from generic OpenAI credentials while hardening JSON-RPC validation, diagnostics redaction, runtime cleanup, and durable-record cancellation.

Validation

• Affected Codex/dev/model suite: 80 passed, 0 failed.
• TypeScript typecheck: passed.
• ESLint: passed.
• Oxlint: passed.
• Prettier format check: passed.
• Knip: passed.
• Live installed Codex OAuth smoke: exact reply marker QM_OAUTH_FINAL_420AFB8; model calls completed with nonzero usage, the child received no ambient API key, base URL, or Codex access token, and the auth lock was cleared.
• Full suite: 3,739 tests, 3,603 passed, 4 failed, 132 skipped. The four failures are Gmail MIME tests requiring Python 3.10 union syntax while this host provides Python 3.9.6; they do not involve OAuth changes.
• Slack/browser QA is intentionally deferred; Slack setup is not required for Codex OAuth.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[rajpratham1]

LGTM. This is a well-structured implementation of ChatGPT OAuth support for the Codex harness. The feature is integrated consistently across configuration, runtime, developer tooling, and security validation, with strong accompanying test coverage. I don't see any blocking issues in the current diff. The main thing to verify through CI is that both API-key and OAuth authentication paths continue to work correctly and that production restrictions behave as expected.

[ReganBell]

Superseded by #690, which combines this with #128 and reconciles both with current main. Your work is credited there as co-author — thank you!

[time-attack]

Thanks for this, @eddie333016 — and sorry for the slow response.

We're closing this PR. Per CONTRIBUTING.md, since coding agents write most of the underlying code now, we'd rather receive feature ideas as a short human-written note in adrs/ — informal is great, just the idea in your own words — and bugs as a plain issue. If we're aligned we're happy to burn our own tokens on the implementation, and we'll credit you as co-author.

We don't want your idea to get lost, so we've captured it in #745 to triage on our side. Please feel free to open an adrs/ note if you feel strongly about the approach. Appreciate you engaging with the repo!