Route Ollama through the shared HTTP client (#36078)

## Why

Ollama requests need to honor Codex's configured outbound proxy policy and custom CA handling.

## What changed

- Replace Ollama's direct `reqwest` client with a route-aware client created by `codex-http-client`.
- Preserve the five-second connection timeout and legacy system-root fallback for default-routed requests.
- Reuse one Ollama client for connectivity, version, model discovery, and model-pull checks.
- Surface HTTP transport initialization errors instead of replacing them with the generic Ollama connection error.

## Testing

- Cover system-proxy routing and invalid `CODEX_CA_CERTIFICATE` and `SSL_CERT_FILE` values under both outbound proxy policies.
- Verify that version and model checks reuse the existing Ollama client.

GitOrigin-RevId: c7cc36845a9bceb57ce5524b9e1b3cbe317897a3

codex-rs/Cargo.lock

@@ -3732,11 +3732,11 @@ dependencies = [
  "async-stream",
  "bytes",
  "codex-core",
+ "codex-http-client",
  "codex-model-provider-info",
  "futures",
  "memchr",
  "pretty_assertions",
- "reqwest 0.12.28",
  "semver",
  "serde_json",
  "tokio",