Share runtime authentication across requests and credential refreshes (#55413)

## What changed

Add `RuntimeAuthManager` to share one registered runtime per credential source and return request-scoped `RuntimeAuth` values that pair the runtime with its credentials and HTTP client factory.

- Preserve registration keys and idempotency IDs across retryable failures and refreshes that retain the credential source.
- Replace the runtime when the credential source changes, preserve existing request snapshots, and reject late registration responses for a previous source.
- Use bounded credential recovery for registration `401` responses and cache `403` denials until the credential source changes.
- Expose authenticated actor and agent host information on `RuntimeAgentInstance`.

## Testing

Add tests for concurrent registration sharing, retry identity preservation, network policy recovery, credential refresh and replacement, bounded recovery, cached denials, and credential changes during registration.

GitOrigin-RevId: ea1e6e10a5939e8c3f7c0c317ccf8a83522c635f

codex-rs/runtime-agent-instance/src/actor.rs

@@ -0,0 +1,29 @@
+//! Actor and host information returned by composite registration, without another hydration call.
+
+use crate::ActorInfo;
+use crate::AgentHostAuthorization;
+
+pub struct AuthenticatedActor {
+    pub(crate) info: ActorInfo,
+}
+
+impl AuthenticatedActor {
+    pub fn info(&self) -> &ActorInfo {
+        &self.info
+    }
+}
+
+pub struct AgentHost {
+    pub(crate) id: String,
+    pub(crate) authorization: AgentHostAuthorization,
+}
+
+impl AgentHost {
+    pub fn id(&self) -> &str {
+        &self.id
+    }
+
+    pub fn authorization(&self) -> &AgentHostAuthorization {
+        &self.authorization
+    }
+}