Add stdin bearer authentication for exec-server registration (#59254)

## Why

Allow remote exec-server registration to use credentials independently of Codex login while retaining the usual local configuration and plugins.

## What changed

- Add `--registration-bearer-stdin` to read one newline-terminated bearer and use it for remote registration.
- Validate the bearer, require HTTPS or HTTP loopback for the registry, and disable process dumpability on Linux before reading the credential.
- Document the option and its distinction from rotating credentials via `--executor-credential-stdin`.

## Testing

Add integration coverage for registration with the supplied bearer across desktop sign-in states, rejection of non-loopback HTTP registries, and restricted process environment access on Linux. Update CLI help snapshots.

GitOrigin-RevId: da99492270c5dc6bb5e0cac41947e9c999a72b75

codex-rs/exec-server-cli/src/command.rs

@@ -106,6 +106,15 @@ pub struct ExecServerCommand {
     )]
     use_agent_identity_auth: bool,
 
+    /// Read one registration bearer from stdin.
+    #[arg(
+        long,
+        requires = "exec_server_remote",
+        conflicts_with_all = ["use_agent_identity_auth", "executor_credential_stdin", "aws_sigv4"],
+        global = true
+    )]
+    registration_bearer_stdin: bool,
+
     /// Read rotating executor credentials from stdin; exit when the pipe closes.
     #[arg(
         long = "executor-credential-stdin",
@@ -194,6 +203,10 @@ impl ExecServerCommand {
             let environment_id = self.environment_id.take().ok_or_else(|| {
                 anyhow::anyhow!("--environment-id is required when --remote is set")
             })?;
+            let registration_auth = self
+                .registration_bearer_stdin
+                .then(codex_exec_server::registration_auth_from_stdin)
+                .transpose()?;
             let config =
                 load_exec_server_config(root_config_overrides, strict_config, enable_cloud_config)
                     .await?;
@@ -228,6 +241,8 @@ impl ExecServerCommand {
                     config.http_client_factory(),
                 )
                 .await?
+            } else if let Some(provider) = registration_auth {
+                provider
             } else {
                 load_exec_server_remote_auth_provider(
                     &config,
@@ -247,7 +262,7 @@ impl ExecServerCommand {
                 auth_provider,
                 config.http_client_factory(),
             )?;
-            if self.executor_credential_stdin {
+            if self.executor_credential_stdin || self.registration_bearer_stdin {
                 remote_config = remote_config.with_executor_credential_auth()?;
             }
             if let Some(name) = self.name {
@@ -342,6 +357,7 @@ impl ExecServerCommand {
         self.remote.is_some()
             && self.command.is_none()
             && !self.executor_credential_stdin
+            && !self.registration_bearer_stdin
             && !self.aws_sigv4
             && !self.use_agent_identity_auth
     }

codex-rs/exec-server-cli/src/snapshots/codex_exec_server_cli__command__tests__standalone_help_documents_executor_options.snap

@@ -93,6 +93,9 @@ Options:
           Use Agent Identity auth from CODEX_ACCESS_TOKEN for remote
           registration
 
+      --registration-bearer-stdin
+          Read one registration bearer from stdin
+
       --executor-credential-stdin
           Read rotating executor credentials from stdin; exit when the pipe
           closes