Use runtime authentication for Analytics requests (#60101)

## What changed

- Honor `RuntimeAgentInstances` and the configured runtime auth mode for Analytics plan discovery and report requests to OpenAI endpoints.
- Share installation ID resolution and Codex runtime registration setup through `codex-runtime-agent-instance`.
- Preserve typed runtime authentication errors so expired credentials retain the “Sign in again to load Analytics” guidance.

## Testing

Add coverage for both runtime auth modes across regional and staging endpoints, fresh assertions for each request, sign-in guidance after bootstrap failure, redirect rejection, and invalid organization/project selectors.

GitOrigin-RevId: 50e0d959b3abd81ebe7a6a584e272f14cf52e504

codex-rs/runtime-agent-instance/src/binding.rs

@@ -386,12 +386,16 @@ pub enum RuntimeAuthError {
     Unsupported,
     #[error("organization and project selection requires an OpenAI API key")]
     UnsupportedResourceSelection,
+    #[error("invalid {0} resource selector")]
+    InvalidResourceSelection(&'static str),
     #[error("credentials changed during runtime registration; try again")]
     Changed,
     #[error("runtime registration could not refresh actor credentials")]
     RefreshFailed,
     #[error(transparent)]
     RefreshTokenFailed(#[from] RefreshTokenFailedError),
+    #[error("runtime auth task failed: {0}")]
+    Task(#[from] tokio::task::JoinError),
     #[error("failed to generate runtime signing key")]
     KeyGeneration,
     #[error(transparent)]