Add correlated diagnostics for Noise relay handshakes (#55498)

## What changed

- Record executor handshake rejections and pending-validation resets in promptly completed diagnostic spans, with classified reasons and registry HTTP status when available. Normalize stream IDs as UUIDs and cap diagnostics at 100 per minute per relay connection, followed by a suppression marker.
- Add elapsed time and connection identifiers to harness handshake diagnostics, including initialization timeouts, and classify WebSocket read failures from typed errors.
- Forward valid stream UUIDs to harness key validation requests through the `x-codex-noise-stream-id` header.

## Testing

Extend tests to cover diagnostic rate limits, timeout correlation, prompt span export, typed WebSocket error classification, and optional stream ID headers. Verify that diagnostic output excludes authorization secrets, registry response text, reset reasons, and invalid stream IDs.

GitOrigin-RevId: 2c224e2d2828b300164868b10806add410e148b2

codex-rs/exec-server/src/remote/noise_tests.rs

@@ -116,7 +116,7 @@ async fn registry_requests_do_not_log_sensitive_urls_or_response_headers() -> Re
                     )
                     .set_body_json(response),
             )
-            .expect(1)
+            .expect(if operation == "validate" { 2 } else { 1 })
             .mount(&server)
             .await;
     }
@@ -134,13 +134,51 @@ async fn registry_requests_do_not_log_sensitive_urls_or_response_headers() -> Re
     client
         .connect_environment("environment-requested", harness_public_key.clone())
         .await?;
-    RegistryHarnessKeyValidator {
+    let validator = RegistryHarnessKeyValidator {
         client,
         environment_id: "environment-requested".to_string(),
         executor_registration_id: "registration-1".to_string(),
-    }
-    .validate_harness_key(&harness_public_key, HARNESS_KEY_AUTHORIZATION)
-    .await?;
+    };
+    let stream_id = uuid::Uuid::new_v4();
+    validator
+        .validate_harness_key(
+            &harness_public_key,
+            HARNESS_KEY_AUTHORIZATION,
+            Some(stream_id),
+        )
+        .await?;
+    validator
+        .validate_harness_key(
+            &harness_public_key,
+            HARNESS_KEY_AUTHORIZATION,
+            /*stream_id*/ None,
+        )
+        .await?;
+
+    let requests = server.received_requests().await.expect("recorded requests");
+    let validation_requests: Vec<_> = requests
+        .iter()
+        .filter(|request| {
+            request
+                .url
+                .query_pairs()
+                .any(|(key, value)| key == "registry_token" && value.ends_with("/validate"))
+        })
+        .collect();
+    assert_eq!(validation_requests.len(), 2);
+    assert_eq!(
+        validation_requests[0]
+            .headers
+            .get("x-codex-noise-stream-id")
+            .map(|value| value.to_str().unwrap()),
+        Some(stream_id.to_string().as_str())
+    );
+    assert!(
+        validation_requests[1]
+            .headers
+            .get("x-codex-noise-stream-id")
+            .is_none()
+    );
 
     let logs = String::from_utf8(log_buffer.lock().expect("log buffer lock").clone())?;
     assert!(logs.contains("registry log capture sentinel"));
@@ -305,7 +343,11 @@ async fn validate_harness_key_requires_explicit_valid_response() {
         environment_id: "environment-requested".to_string(),
         executor_registration_id: "registration-1".to_string(),
     }
-    .validate_harness_key(&harness_public_key, HARNESS_KEY_AUTHORIZATION)
+    .validate_harness_key(
+        &harness_public_key,
+        HARNESS_KEY_AUTHORIZATION,
+        /*stream_id*/ None,
+    )
     .await
     .expect_err("a false validation response must fail closed");
 
@@ -335,7 +377,11 @@ async fn validate_harness_key_does_not_expose_error_body() {
         environment_id: "environment-requested".to_string(),
         executor_registration_id: "registration-1".to_string(),
     }
-    .validate_harness_key(&harness_public_key, HARNESS_KEY_AUTHORIZATION)
+    .validate_harness_key(
+        &harness_public_key,
+        HARNESS_KEY_AUTHORIZATION,
+        /*stream_id*/ None,
+    )
     .await
     .expect_err("validation HTTP error should fail closed");