Fail closed when workload identity initialization fails (#38424)

## What changed

- Treat workload identity environment markers as an explicit authentication selection, even when another process credential is present.
- Return initialization errors from `AuthManager` and propagate them through commands and services instead of continuing with an unusable authentication state.
- Make `codex login status` validate workload identity, keep the TUI on an embedded app server for local workload identity, and reject workload identity in `codex mcp-server`, where it is unsupported.

## Testing

- Cover workload identity precedence and partial configuration errors.
- Verify login status reports an unreadable identity assertion and app-server routing enforces the supported workload identity topology.

GitOrigin-RevId: efc6b6b4cd4d61652617de82aaa3d7ffc75d6618

codex-rs/cloud-tasks/src/util.rs

@@ -61,8 +61,18 @@ pub async fn load_auth_manager(
     let http_client_factory = config.http_client_factory();
     let mut auth_config = config.auth_config();
     auth_config.chatgpt_base_url = chatgpt_base_url.or(Some(config.chatgpt_base_url.clone()));
-    let auth_manager =
-        AuthManager::shared_from_auth_config(auth_config, /*enable_codex_api_key_env*/ false).await;
+    let auth_manager = match AuthManager::shared_from_auth_config(
+        auth_config,
+        /*enable_codex_api_key_env*/ false,
+    )
+    .await
+    {
+        Ok(auth_manager) => auth_manager,
+        Err(error) => {
+            append_error_log(format!("failed to load auth: {error}"));
+            return (None, http_client_factory);
+        }
+    };
     (Some(auth_manager), http_client_factory)
 }