refactor(exec-server): validate Noise keys at use

Co-authored-by: Codex <noreply@openai.com>

codex-rs/exec-server/src/noise_channel.rs

@@ -51,12 +51,6 @@ impl std::fmt::Debug for NoiseChannelPublicKey {
 }
 
 impl NoiseChannelPublicKey {
-    /// Validate suite selection, encoding, and exact key lengths.
-    pub fn validate(&self) -> Result<(), NoiseChannelError> {
-        let _ = self.decode()?;
-        Ok(())
-    }
-
     fn from_keypairs(dh: &DhKeyPair, kem: &KemKeyPair) -> Self {
         Self {
             suite: NOISE_CHANNEL_SUITE.to_string(),

codex-rs/exec-server/src/noise_channel_tests.rs

@@ -15,7 +15,8 @@ fn public_key_validation_rejects_unknown_suite() {
     let key: NoiseChannelPublicKey =
         serde_json::from_value(serde_json::Value::Object(object)).expect("deserialize key");
 
-    assert!(key.validate().is_err());
+    let initiator = NoiseChannelIdentity::generate().expect("generate initiator identity");
+    assert!(InitiatorHandshake::start(&initiator, &key, b"prologue", b"").is_err());
 }
 
 #[test]