Consolidate async header authentication in apply_auth_headers (#57179)

## What changed

Remove `AuthProvider::resolve_auth_headers` and use `apply_auth_headers` as the async interface for header-only authentication. Migrate providers, callers, and existing tests to the shared interface, passing an empty `HeaderMap` when only authentication headers are needed.

Document that providers may refresh credentials asynchronously and that callers must use the returned header map so providers can remove superseded credentials.

GitOrigin-RevId: 42449de6fddd2be2c50c475c8e92628493197007

codex-rs/exec-server/src/remote.rs

@@ -305,7 +305,7 @@ impl EnvironmentRegistryClient {
     async fn resolve_auth(&self) -> Result<(HeaderMap, Option<HeaderValue>), ExecServerError> {
         let mut headers = self
             .auth_provider
-            .resolve_auth_headers()
+            .apply_auth_headers(HeaderMap::new())
             .await
             .map_err(|error| {
                 ExecServerError::EnvironmentRegistryAuth(format!(
@@ -1132,9 +1132,8 @@ mod tests {
             Ok(())
         }
 
-        fn resolve_auth_headers(&self) -> codex_api::AuthHeadersFuture<'_> {
-            Box::pin(async {
-                let mut headers = HeaderMap::new();
+        fn apply_auth_headers(&self, mut headers: HeaderMap) -> codex_api::AuthHeadersFuture<'_> {
+            Box::pin(async move {
                 let _ = headers.insert(
                     http::header::AUTHORIZATION,
                     HeaderValue::from_static("Bearer registry-token"),

codex-rs/exec-server/src/remote/auth_tests.rs

@@ -55,15 +55,16 @@ impl AuthProvider for RotatingAuth {
         Ok(())
     }
 
-    fn resolve_auth_headers(&self) -> codex_api::AuthHeadersFuture<'_> {
-        Box::pin(async {
+    fn apply_auth_headers(&self, mut headers: HeaderMap) -> codex_api::AuthHeadersFuture<'_> {
+        Box::pin(async move {
             self.stall_at(if self.refreshes.load(Ordering::SeqCst) == 0 {
                 AuthStage::Initial
             } else {
                 AuthStage::Retry
             })
             .await;
-            self.to_auth_headers()
+            self.add_auth_headers(&mut headers)?;
+            Ok(headers)
         })
     }
 

codex-rs/exec-server/src/remote/registration_retry_tests.rs

@@ -47,9 +47,9 @@ impl AuthProvider for RegistrationAuthProvider {
         Ok(())
     }
 
-    fn resolve_auth_headers(&self) -> codex_api::AuthHeadersFuture<'_> {
+    fn apply_auth_headers(&self, headers: HeaderMap) -> codex_api::AuthHeadersFuture<'_> {
         self.calls.fetch_add(1, Ordering::Relaxed);
-        Box::pin(async { Ok(HeaderMap::new()) })
+        Box::pin(async move { Ok(headers) })
     }
 }