Refresh remote exec-server credentials after unauthorized responses (#55987)

## Why

Remote registry requests need to recover when credentials are rejected or rotated while `exec-server` is running. Concurrent requests should reuse refreshed credentials rather than refresh the replacement token again.

## What changed

- Add an `AuthProvider` recovery hook and retry registry registration, connection, and harness-key validation once after a `401` when the provider supplies replacement credentials.
- Use live ChatGPT authentication for remote `exec-server` and guard proactive and unauthorized refreshes so concurrent callers share the completed refresh.
- Allow executor credentials to retry when the parent has already supplied a valid replacement.
- Keep connection authentication, refresh, and retry within the original connection deadline.

## Testing

Add coverage for concurrent refreshes, stored and parent-supplied credential rotation, refresh failures, retry limits, and connection deadlines, plus a CLI integration test for refresh and credential reload in a running executor.

GitOrigin-RevId: 9ed533e410762c7ac8b7c0c30bb93fd20d96778b

codex-rs/cli/src/exec_server_command.rs

@@ -431,7 +431,7 @@ async fn load_exec_server_remote_auth_provider(
         validate_api_key_remote_host(base_url)?;
     }
 
-    if auth_manager.is_workload_identity_selected() {
+    if auth.is_chatgpt_auth() || auth_manager.is_workload_identity_selected() {
         Ok(codex_model_provider::auth_provider_from_auth_manager(
             auth_manager,
             &auth,