Allow providers to opt into Cyber access programs (#58190)

## Why

Cyber access program selection was restricted to the `openai` provider ID, preventing custom providers from accepting explicit program selections.

## What changed

- Add `capabilities.cyber_access_programs` to provider configuration and preserve it through remote thread configuration. Default to enabled for `openai` and disabled for other provider IDs, with explicit overrides taking precedence.
- Use the capability when forwarding `access_programs.cyber` and determining Daybreak availability in exec and the TUI. Refresh TUI eligibility when the server changes the selected provider.
- Preserve authentication, API-key feature gates, and catalog access checks; the capability does not grant program access.

## Testing

Add coverage for capability defaults and overrides, configuration round trips, custom-provider requests with both authentication types, API-key feature gating, compaction, WebSocket response reuse, exec selection, and TUI provider changes.

GitOrigin-RevId: 579f7c33c9e857ff5fedd08311aa8e3129740c1f

codex-rs/exec/src/daybreak.rs

@@ -11,6 +11,7 @@ use codex_app_server_protocol::ModelListParams;
 use codex_app_server_protocol::ModelListResponse;
 use codex_features::Feature;
 use codex_features::Features;
+use codex_model_provider_info::ModelProviderInfo;
 use codex_protocol::openai_models::ModelAccessPrograms;
 
 pub(crate) async fn program_for_turn(
@@ -18,11 +19,15 @@ pub(crate) async fn program_for_turn(
     client: &InProcessAppServerClient,
     request_ids: &mut RequestIdSequencer,
     model: &str,
-    provider: &str,
+    provider_id: &str,
+    provider: Option<&ModelProviderInfo>,
     enabled: bool,
 ) -> anyhow::Result<Option<CyberAccessProgram>> {
-    if provider != "openai" {
-        anyhow::ensure!(!enabled, "Daybreak requires the OpenAI model provider");
+    if !provider.is_some_and(|provider| provider.supports_cyber_access_programs(provider_id)) {
+        anyhow::ensure!(
+            !enabled,
+            "Daybreak requires a model provider with Cyber access program support"
+        );
         return Ok(None);
     }
 

codex-rs/exec/src/lib.rs

@@ -1228,6 +1228,9 @@ async fn run_exec_session(args: ExecRunArgs) -> anyhow::Result<()> {
                         &mut request_ids,
                         &session_configured.model,
                         &session_configured.model_provider_id,
+                        config
+                            .model_providers
+                            .get(&session_configured.model_provider_id),
                         daybreak_enabled,
                     )
                     .await?