Stop retrying terminal runtime authentication denials (#60096)

## Why

Invalid assertions and paused or revoked runtime instances cannot recover through request retries or credential refresh. Permanent refresh-token failures also need to retain their sign-in error instead of becoming retryable stream errors.

## What changed

- Recognize terminal runtime denial codes in `401` and `403` response bodies and identity error headers, preserving HTTP diagnostics while stopping retries.
- Skip credential recovery for runtime denials in runtime-enabled model providers and backend requests, while preserving recovery for ordinary credential expiration.
- Propagate permanent refresh-token failures through runtime authentication as `RefreshTokenFailed` errors.

## Testing

Add coverage for body and header denials, preserved HTTP diagnostics, provider-scoped credential recovery, and cached permanent refresh failures. Complete-turn tests verify that runtime denials stop without retries or refreshes while expired credentials recover in both runtime authentication modes.

GitOrigin-RevId: 33f6f707454130e97e13f3b53e29d2c484602152

codex-rs/runtime-agent-instance/src/auth.rs

@@ -183,6 +183,7 @@ impl From<RuntimeAuthError> for AuthError {
             | RuntimeAuthError::UnsupportedResourceSelection
             | RuntimeAuthError::Changed
             | RuntimeAuthError::RefreshFailed
+            | RuntimeAuthError::RefreshTokenFailed(_)
             | RuntimeAuthError::KeyGeneration
             | RuntimeAuthError::Registration(
                 RegistrationError::InvalidEndpoint