## What changed
Add `RuntimeAuthManager` to share one registered runtime per credential source and return request-scoped `RuntimeAuth` values that pair the runtime with its credentials and HTTP client factory.
- Preserve registration keys and idempotency IDs across retryable failures and refreshes that retain the credential source.
- Replace the runtime when the credential source changes, preserve existing request snapshots, and reject late registration responses for a previous source.
- Use bounded credential recovery for registration `401` responses and cache `403` denials until the credential source changes.
- Expose authenticated actor and agent host information on `RuntimeAgentInstance`.
## Testing
Add tests for concurrent registration sharing, retry identity preservation, network policy recovery, credential refresh and replacement, bounded recovery, cached denials, and credential changes during registration.
GitOrigin-RevId: ea1e6e10a5939e8c3f7c0c317ccf8a83522c635f
## What changed
Extend `codex-runtime-agent-instance` with a registration client and an in-memory assertion signer. Pending registrations retain their signing key and idempotency key across caller-driven retries; registered runtimes generate fresh versioned assertions with a timestamp and unique ID.
Bound registration requests and responses, reject unsafe endpoints, disable redirects and request logging, and preserve network policy errors. Report server rejections using only the status and recognized error codes.
## Testing
Add HTTP-backed tests for retry stability, assertion signatures and freshness, policy revocation, endpoint and response validation, redirect refusal, and error redaction.
GitOrigin-RevId: a6dab0900459dfb75f72652a0a2ee1e4b65ca322
cooper-oai