## What changed
- Add a host-owned external auth source that runtime account APIs cannot replace,
clear, or log out, and keep its credentials process-local instead of writing
them to auth storage.
- Let configured providers classify refresh failures. Preserve cached credentials
after permanent reload failures while retaining transient behavior for runtime
providers.
- Compare external ChatGPT token data when detecting auth changes so a refreshed
access token is applied to a retried request.
## Testing
- Cover configured-auth immutability, process-local storage, permanent reload
failures, runtime error classification, and refreshed headers after a `401`.
GitOrigin-RevId: c6d70a39325c8ba6ca65ae68e12b55609f00a876
## Why
`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.
## What changed
- Use `http` header and status types directly in core code and tests.
- Build the MCP test readiness client through `HttpClientBuilder`.
- Remove `reqwest` from `codex-core` and its temporary dependency-policy
exception.
GitOrigin-RevId: 8d5c7c86256294a7bb8aa1ae10cc5bea4cb1fc56