Add rotating stdin credentials for remote exec-server (#54434)

## What changed

- Add `--executor-credential-stdin` to read newline-delimited JSON credentials bound to the configured environment. Require an initial credential within 30 seconds and accept subsequent rotations.
- Reject expired credentials on each request, and stop the executor on invalid input or stdin closure. Limit credential frames to 16 KiB.
- Use scoped bearer authentication for registry requests without account credential fallback or WebSocket authentication headers. Skip workload identity loading and configured telemetry exporters in this mode.

## Testing

Add unit and integration coverage for rotation, expiry, malformed frames, environment mismatches, stdin closure, registry-only authentication, credential redaction, and telemetry exporter isolation.

GitOrigin-RevId: 30a94478165395144a765450f5ec6b3697acdd55

codex-rs/cli/src/main.rs

@@ -66,6 +66,7 @@ mod exec_args_tests;
 mod exec_server_args_tests;
 mod exec_server_auth;
 mod exec_server_command;
+mod exec_server_credential;
 mod exec_server_telemetry;
 mod marketplace_cmd;
 mod mcp_cmd;