Treat access program denials as terminal errors (#60476)

## What changed

Recognize `access_program_not_enabled` in HTTP 403 responses and response stream errors as a dedicated, non-retryable error. Preserve HTTP diagnostic details and provider stream messages, with a default message when none is supplied.

Stop SSE streams immediately on this error and avoid triggering WebSocket fallback for explicit access program denials. Add a fixed diagnostic label for doctor output and telemetry.

## Testing

Extend coverage for HTTP and WebSocket denials, immediate SSE termination despite retry headers, and doctor diagnostic redaction.

GitOrigin-RevId: 3a41f7bb80ad5e13a87e831b458d17cdd19a4b62

codex-rs/response-debug-context/src/lib.rs

@@ -93,6 +93,7 @@ pub fn telemetry_api_error_message(error: &ApiError) -> String {
         ApiError::RateLimitExceeded { .. } => "rate limit exceeded".to_string(),
         ApiError::RateLimit(_) => "rate limit".to_string(),
         ApiError::ModelNotFound { .. } => "model not found".to_string(),
+        ApiError::AccessProgramNotEnabled { .. } => "access program not enabled".to_string(),
         ApiError::InvalidRequest { .. }
         | ApiError::InvalidAudioInput { .. }
         | ApiError::InvalidPrompt { .. } => "invalid request".to_string(),