Wire shared runtime authentication through threads and API clients (#59177)

## What changed

- Share a lazily registered runtime across threads, model discovery, and extension clients when `runtime_agent_instances` is enabled, while honoring each thread's authentication mode and credential owner.
- Bind model catalogs to the effective provider and authentication context while preserving cache policy and live API-key discovery settings.
- Resolve credentials, routing, and transport policy together for each request. Preserve proxy and TLS settings, validate runtime account selectors, and prevent pooled connections from crossing runtime identities.
- Accept supported ChatGPT subdomains when selecting the registration environment.

## Testing

Add integration coverage for shared runtime registration, dual-header and assertion-only modes, disabled and third-party providers, credential replacement, subagents, and delegated review. Add coverage for catalog cache policy and runtime-aware connection reuse.

GitOrigin-RevId: 99dd9d987c29c93597a648f6586f98ac6a932c3c

codex-rs/thread-manager-sample/src/main.rs

@@ -35,6 +35,7 @@ use codex_core_api::GhostSnapshotConfig;
 use codex_core_api::History;
 use codex_core_api::MemoriesConfig;
 use codex_core_api::ModelAvailabilityNuxConfig;
+use codex_core_api::ModelCatalogSettings;
 use codex_core_api::MultiAgentV2Config;
 use codex_core_api::NewThread;
 use codex_core_api::Notice;
@@ -64,7 +65,6 @@ use codex_core_api::UserInput;
 use codex_core_api::WebSearchMode;
 use codex_core_api::arg0_dispatch_or_else;
 use codex_core_api::bootstrap_auth_config;
-use codex_core_api::build_models_manager;
 use codex_core_api::built_in_model_providers;
 use codex_core_api::find_codex_home;
 use codex_core_api::init_state_db;
@@ -146,10 +146,15 @@ async fn run_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
     install_image_generation_extension(&mut extensions, auth_manager.clone(), |config: &Config| {
         Some(config.codex_home.clone())
     });
-    let thread_manager = ThreadManager::new(
+    let startup = codex_core_api::build_startup_models(
         &config,
         Arc::clone(&auth_manager),
-        build_models_manager(&config, auth_manager),
+        installation_id,
+        Arc::new(ModelCatalogSettings::disk(config.codex_home.to_path_buf())),
+    );
+    let thread_manager = ThreadManager::new(
+        &config,
+        startup,
         CodexAppsToolsCache::default(),
         SessionSource::Exec,
         environment_manager,
@@ -159,7 +164,6 @@ async fn run_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
         passthrough_image_store(),
         Arc::clone(&thread_store),
         local_agent_graph_store_from_state_db(state_db.as_ref()),
-        installation_id,
         /*attestation_provider*/ None,
         /*external_time_provider*/ None,
     );
@@ -394,6 +398,7 @@ async fn new_config(
         rollout_budget: None,
         current_time_reminder: None,
         sleep_tool_mode: Default::default(),
+        runtime_auth_mode: Default::default(),
         features: Default::default(),
         prefer_mxc: false,