Add ChatGPT token stdin authentication to exec-server (#59569)

## What changed

- Add `--chatgpt-token-stdin` for remote HTTPS registration and optional `--chatgpt-account-id`, which must match the token's account claim when present. Read a bounded, newline-terminated token from a pipe without persisting it to `auth.json`.
- Load managed configuration using the supplied account, enforce account restrictions, and preserve configured policy-server authentication. Skip ChatGPT policy lookup only for known plans that do not require managed configuration.
- Allow `--exit-on-stdin-close` to cancel pending policy loading, and redact the registration bearer from registry diagnostics.
- Reject incompatible stdin credential options, including flags placed on opposite sides of `forward`, and disallow ChatGPT token stdin authentication with `forward`.

## Testing

Add coverage for account-claim validation, policy selection, policy-server sign-in requirements, shutdown during policy loading, credential flag conflicts, and bearer redaction.

GitOrigin-RevId: b6b50565e1f150b96edf3cee796909a991f1b47f

codex-rs/exec-server-cli/src/exec_server_args_tests.rs

@@ -50,7 +50,7 @@ fn exec_server_defaults_preserve_local_and_noise_modes() {
 
 #[test]
 fn remote_forwarder_skips_cloud_config() {
-    let command = exec_server_from_args(&[
+    let mut command = exec_server_from_args(&[
         "forward",
         "--connect",
         "ws://localhost:8765",
@@ -60,6 +60,8 @@ fn remote_forwarder_skips_cloud_config() {
         "env-1",
     ]);
     assert!(!command.should_load_cloud_config());
+    command.chatgpt_token_stdin = true;
+    assert!(command.validate_remote_transport().is_err());
 }
 
 #[test]
@@ -165,6 +167,18 @@ fn exec_server_rejects_missing_or_conflicting_remote_options() {
             vec!["--executor-credential-stdin", "--use-agent-identity-auth"],
             ErrorKind::ArgumentConflict,
         ),
+        (
+            vec!["--executor-credential-stdin", "--registration-bearer-stdin"],
+            ErrorKind::ArgumentConflict,
+        ),
+        (
+            vec!["--chatgpt-token-stdin", "--executor-credential-stdin"],
+            ErrorKind::ArgumentConflict,
+        ),
+        (
+            vec!["--chatgpt-token-stdin", "--registration-bearer-stdin"],
+            ErrorKind::ArgumentConflict,
+        ),
         (
             vec![
                 "--executor-credential-stdin",