Add rotating stdin credentials for remote exec-server (#54434)

## What changed

- Add `--executor-credential-stdin` to read newline-delimited JSON credentials bound to the configured environment. Require an initial credential within 30 seconds and accept subsequent rotations.
- Reject expired credentials on each request, and stop the executor on invalid input or stdin closure. Limit credential frames to 16 KiB.
- Use scoped bearer authentication for registry requests without account credential fallback or WebSocket authentication headers. Skip workload identity loading and configured telemetry exporters in this mode.

## Testing

Add unit and integration coverage for rotation, expiry, malformed frames, environment mismatches, stdin closure, registry-only authentication, credential redaction, and telemetry exporter isolation.

GitOrigin-RevId: 30a94478165395144a765450f5ec6b3697acdd55

codex-rs/cli/src/exec_server_telemetry.rs

@@ -10,6 +10,7 @@ const OTEL_SERVICE_NAME: &str = "codex-exec-server";
 pub(crate) enum ParentLifetime {
     Independent,
     StdinPipe,
+    MonitoredStdin(tokio::sync::oneshot::Receiver<()>),
 }
 
 pub(crate) enum ShutdownBehavior {
@@ -65,6 +66,7 @@ where
 {
     let parent_disconnected = match parent_lifetime {
         ParentLifetime::Independent => None,
+        ParentLifetime::MonitoredStdin(receiver) => Some(receiver),
         ParentLifetime::StdinPipe => {
             let (sender, receiver) = tokio::sync::oneshot::channel();
             std::thread::spawn(move || {