Converge OpenAI Codex credentials with protected OAuth lifecycle

Problem

The experimental openai-codex provider currently consumes a manually supplied OAuth access-token/account snapshot from the plaintext operator auth.yaml credential file. It has no browser login, refresh, protected credential-store integration, or token lifecycle.

This differs from Mecatl-owned OIDC provider enrollment, which stores identity-bound encrypted records in the protected credential store and supports the established login/refresh/logout lifecycle. It also prevents the file currently named auth.yaml from being accurately described as API-key-only.

Goal

Converge openai-codex credential custody and lifecycle with Mecatl's existing protected OAuth/OIDC mechanisms, while preserving the provider's distinct billing identity, entitlement-authoritative model inventory, and private Codex endpoint policy.

Scope

• Define the appropriate protected credential-store record and identity binding for openai-codex.
• Add a deliberate local enrollment/refresh/logout lifecycle only if the upstream protocol and security contract support it.
• Migrate or retire the manual providers.openai-codex.oauth auth.yaml record through an explicit compatibility plan.
• Preserve the current non-impersonation requirement (originator: mecatl) and distinct openai-codex provider identity.
• Update documentation and configuration terminology once the plaintext manual-token compatibility path is retired.

Non-goals

• Do not merge the current API-key provider configuration redesign with this work.
• Do not treat a ChatGPT/Codex subscription as an OpenAI public API key or merge the openai and openai-codex providers.
• Do not add a model-facing credential flow or remote client enrollment.

Context

• ADR 0215 deliberately chose an immutable manual token as the first experimental release and deferred login, refresh, expiry management, and keyring storage.
• openai-codex is distinct from public openai: it uses ChatGPT subscription credentials and the private Codex compatibility endpoint.
• The provider-configuration redesign should remain bounded for now: auth.yaml continues to contain the existing Codex OAuth record, so it cannot yet be renamed or presented as API-key-only.

Relates to PR #1441 and the follow-up provider-unification design.