Fix enterprise MCP credential selection and reauthentication (#55859)

## What changed

- Prefer an eligible account grant over saved enterprise credentials, with a fallback to saved enterprise sign-in during initial connection if the account grant is rejected.
- Remember rejected account grants per enterprise MCP registration across threads and report authentication failures as requiring reauthentication. Keep administrator configuration errors distinct from sign-in failures.
- Compare account grants independently of access and ID token rotation, recheck the latest identity eligibility after exchange, and retry once when the refresh grant changes.
- Make MCP authentication status reflect usable account grants, saved enterprise credentials, and completed connection failures.

## Testing

Extend regression coverage for enterprise sign-in failures and recovery, MCP authentication status, account grant identity across token refreshes, and retries after transient credential failures.

GitOrigin-RevId: eeac65f668d5d2d55e9d8bf4547fbcbdd6a6c42d

codex-rs/codex-mcp/src/runtime/status.rs

@@ -40,11 +40,24 @@ impl McpRuntime {
                 && expected_registration
                     .is_none_or(|expected| config.mcp_server_catalog.server(name) == Some(expected))
         });
+        if config.xaa_enabled
+            && servers
+                .values()
+                .any(|server| matches!(server.config().auth, codex_config::McpServerAuth::EmaAuth))
+        {
+            // Finish selected startup and any rejected-grant cleanup before reading auth.
+            current
+                .connections
+                .list_available_server_infos(|name| name == server)
+                .await;
+        }
         let auth_statuses = compute_auth_statuses(
             servers.iter(),
             config.mcp_oauth_credentials_store_mode,
             config.auth_keyring_backend_kind,
             current.auth.as_ref(),
+            current.auth_manager.as_ref(),
+            &config.ema_state,
             &runtime_context,
         )
         .await;