Support workload identity in remote exec-server auth (#38610)

## Why

Remote exec-server registry requests need to refresh managed credentials before sending a request. Static auth-header resolution cannot perform the asynchronous token exchange required by workload identity.

## What changed

- Add asynchronous auth-header resolution to `AuthProvider`, with the existing static-header behavior as the default.
- Resolve fresh managed credentials for each remote environment registry request while preserving the expected account and workspace identity.
- Load the cloud configuration bundle during remote exec-server startup when workload identity is selected.

## Testing

- Update the managed-auth and environment-registry auth tests to exercise asynchronous header resolution.

GitOrigin-RevId: 5d60f1127467aaacdb5d1a8f3d92278bc4bf2e29

codex-rs/codex-api/src/auth.rs

@@ -41,6 +41,15 @@ pub trait AuthProvider: Send + Sync {
         headers
     }
 
+    /// Resolves auth headers for an outbound request.
+    ///
+    /// Unlike [`Self::to_auth_headers`], implementations may perform asynchronous work to refresh
+    /// credentials before returning. Header-only providers with static credentials can rely on the
+    /// default implementation.
+    fn resolve_auth_headers(&self) -> AuthHeadersFuture<'_> {
+        Box::pin(async { Ok(self.to_auth_headers()) })
+    }
+
     /// Applies auth to a complete outbound request and returns the request to send.
     ///
     /// The input `request` is moved into this method. Implementations may mutate
@@ -55,7 +64,7 @@ pub trait AuthProvider: Send + Sync {
     fn apply_auth(&self, request: Request) -> AuthProviderFuture<'_> {
         Box::pin(async move {
             let mut request = request;
-            self.add_auth_headers(&mut request.headers);
+            request.headers.extend(self.resolve_auth_headers().await?);
             Ok(request)
         })
     }
@@ -64,6 +73,9 @@ pub trait AuthProvider: Send + Sync {
 pub type AuthProviderFuture<'a> =
     Pin<Box<dyn Future<Output = Result<Request, AuthError>> + Send + 'a>>;
 
+pub type AuthHeadersFuture<'a> =
+    Pin<Box<dyn Future<Output = Result<HeaderMap, AuthError>> + Send + 'a>>;
+
 /// Shared auth handle passed through API clients.
 pub type SharedAuthProvider = Arc<dyn AuthProvider>;
 

codex-rs/codex-api/src/lib.rs

@@ -22,6 +22,7 @@ pub use crate::api_bridge::map_api_error;
 pub use crate::auth::AgentIdentityTelemetry;
 pub use crate::auth::AuthError;
 pub use crate::auth::AuthHeaderTelemetry;
+pub use crate::auth::AuthHeadersFuture;
 pub use crate::auth::AuthProvider;
 pub use crate::auth::AuthProviderFuture;
 pub use crate::auth::SharedAuthProvider;