Integrate runtime authentication into model requests (#57171)

## What changed

- Add opt-in runtime authentication through `ModelClient::with_runtime_auth`, requiring the provider and runtime manager to share the selected OpenAI credentials.
- Keep runtime identity, credentials, routing, and transport selection consistent for each request and its retries, signing a fresh assertion for each attempt.
- Apply authentication asynchronously to WebSocket handshakes, replace stale authentication headers, and reconnect when the runtime changes.
- Reject account, organization, or project selectors that conflict with the registered runtime, and preserve gateway OAuth composition.

## Testing

Add coverage for dual-header and assertion-only authentication, HTTP retries, runtime replacement and account switches, stale WebSocket headers, selector mismatches, gateway OAuth failures, transport revocation, and Realtime compatibility.

GitOrigin-RevId: 45b9efc2c80481406a0f6f6396a8cdd21d933c12

codex-rs/runtime-agent-instance/src/manager.rs

@@ -43,7 +43,18 @@ enum RuntimeState {
     },
 }
 
+impl std::fmt::Debug for RuntimeAuthManager {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RuntimeAuthManager").finish_non_exhaustive()
+    }
+}
+
 impl RuntimeAuthManager {
+    /// Check that a consumer uses this owner's credential provider, not an ambient fallback.
+    pub fn uses_credentials(&self, credentials: &Arc<AuthManager>) -> bool {
+        Arc::ptr_eq(&self.credentials, credentials)
+    }
+
     pub fn new(
         credentials: Arc<AuthManager>,
         host: AgentHostAuthorization,