Refine enterprise MCP auth errors and request authority checks (#55691)

## What changed

- Classify token-source failures by credential kind and exchange stage, with sign-in or administrator guidance that omits provider error text. Treat resource authorization failures separately from enterprise identity failures when deciding whether authentication is required.
- Add policy-bound request authority checks that return `RequestNotSent` when policy is updating or unavailable, while allowing admitted responses to finish. Support child authorities that isolate connection revocation and share response draining.
- Recheck account validity after acquiring the credential invalidation lock and check cancellation before deleting a rejected credential.

## Testing

Extend regression coverage for policy suspension during token renewal, completion of admitted requests, recovery with fresh authority, and transport retry classification. Expand provider-error tests to cover `unauthorized_client` and `invalid_client` while checking that credential text is not exposed.

GitOrigin-RevId: c0097adc35cb5fdffde1466e4bc2b5ec78114a4b

codex-rs/exec-server/src/client.rs

@@ -701,6 +701,8 @@ pub enum ExecServerError {
     Json(#[from] serde_json::Error),
     #[error("HTTP request failed: {0}")]
     HttpRequest(String),
+    #[error("request not sent: {0}")]
+    RequestNotSent(String),
     #[error("authentication required: {0}")]
     AuthenticationRequired(String),
     #[error("exec-server protocol error: {0}")]

codex-rs/exec-server/src/client/connection_failure.rs

@@ -43,6 +43,7 @@ impl ExecServerError {
             | Self::ProvisioningFailed(_)
             | Self::Json(_)
             | Self::HttpRequest(_)
+            | Self::RequestNotSent(_)
             | Self::Protocol(_)
             | Self::AuthenticationRequired(_)
             | Self::ProvisioningModeConflict { .. }