feat(provider-codex): support catalog-selected Responses Lite

[M1k0t0]

Summary

Add provider-side Responses Lite support for Codex while preserving Floway's Standard Responses interface.

• Select Lite exclusively from the Codex model catalog's use_responses_lite capability.
• Encode Standard requests into Codex's Lite representation, including tool declarations, tagged base instructions, default functions namespaces, and scoped image-detail removal. Preserve stable prefix identities for replay without mutating the caller's request.
• Restore Standard callable identities and function/custom stream lifecycles across output items, resource events, argument/input events, and compact results. Restore representation-dependent echoes without overwriting upstream effective reasoning or parallel-tool settings.
• Prepare requests once so a 401 token-refresh retry reuses identical serialized bytes, client identity, mode selection, and inverse mappings. Apply Lite encoding before compact projection so interceptor-added fields survive action pivots.
• Align catalog and request identity with Codex CLI 0.154.0, including the User-Agent, catalog client_version, and version headers.

Compatibility

Models with absent or false Lite capability continue to use Standard Responses. Malformed capability metadata fails before dispatch; upstream Lite failures do not silently fall back to Standard.

The Lite encoder retains unknown request fields and leaves search-loaded tool declarations in place while indexing their callable identities. Compact restoration replaces only matching generated prefixes, preserving caller-owned lookalikes, history, and opaque items.

Successful Lite stream responses hide the private mode marker. Non-OK upstream responses retain their original status, headers, and body.

Bump the model catalog revision from 10 to 11 so existing caches refresh the new private capability metadata. The capability survives persistence without appearing in public model responses.

Scope

This PR is independently based on main. It implements the Codex provider's upstream wire representation, not gateway-side Lite client ingress/egress or source-item continuation persistence.

Test coverage

Added or expanded regression coverage for:

• Catalog-driven mode selection, Standard defaults, malformed metadata, and caller-marker sanitization.
• Tool and instruction encoding, stable IDs, name collisions, implicit namespaces, and image-detail scope.
• Function/custom lifecycle restoration, resource echoes, and effective-setting preservation.
• Compaction prefix provenance, replay, search-loaded tools, and unknown data preservation.
• Byte-for-byte 401 retries, unchanged upstream errors, and generate/compact action pivots.
• Codex CLI identity headers, cache invalidation, SQL round-tripping, and public metadata isolation.