refactor(agent/adapters): simplify codex responses adapter and runtime (-1080 LOC)

Split _preflight_codex_input_items into per-item-type helpers over a
_PreflightCtx; streaming assembly moves into _CodexResponseAssembler with a
per-event dispatch table; run_codex_app_server_turn loses its session/usage/
interrupt regions to _ensure_codex_session/_finish_codex_turn/
_consume_user_interrupt/_queue_token_counts (counts built lazily so stub agents
without a session DB are never touched). Responses input/normalization and
stream callback order verified byte-identical against merge-base.

agent/codex_headers.py

@@ -1,8 +1,8 @@
 """Codex request identity helpers shared by agent client builders.
 
-This leaf module intentionally has no dependency on the large auxiliary-client
-router. Long-lived processes can therefore import a newly added client builder
-without resolving a new symbol from an older cached ``auxiliary_client`` module.
+Leaf module with no dependency on the large auxiliary-client router, so a
+long-lived process can import a newly added client builder without resolving a
+new symbol from an older cached ``auxiliary_client`` module.
 """
 
 from __future__ import annotations
@@ -36,27 +36,19 @@ def codex_cloudflare_headers(
 ) -> Dict[str, str]:
     """Identity and account headers for chatgpt.com/backend-api/codex.
 
-    OpenAI requires third-party harnesses to identify themselves. Requests to
-    the official endpoint always send Hermes' originator and version. Custom
-    endpoints retain the existing compatibility identity. In either case,
-    preserve ``ChatGPT-Account-ID`` from the OAuth JWT's
-    ``chatgpt_account_id`` claim.
-
-    Malformed tokens are tolerated — we drop the account-ID header rather than
-    raise, so a bad token still surfaces as an auth error (401) instead of a
-    crash at client construction.
+    OpenAI requires third-party harnesses to identify themselves: the official
+    endpoint gets Hermes' originator and version, custom endpoints keep the
+    codex_cli_rs compatibility identity. ``ChatGPT-Account-ID`` comes from the
+    OAuth JWT's ``chatgpt_account_id`` claim; a malformed token drops the header
+    rather than raising, so it surfaces as a 401 instead of a crash at client
+    construction.
     """
-    headers = {
-        "User-Agent": "codex_cli_rs/0.0.0 (Hermes Agent)",
-        "originator": "codex_cli_rs",
-    }
     if is_official_codex_base_url(base_url):
         from hermes_cli import __version__
 
-        headers.update({
-            "User-Agent": f"HermesAgent/{__version__}",
-            "originator": "hermes-agent",
-        })
+        headers = {"User-Agent": f"HermesAgent/{__version__}", "originator": "hermes-agent"}
+    else:
+        headers = {"User-Agent": "codex_cli_rs/0.0.0 (Hermes Agent)", "originator": "codex_cli_rs"}
     if not isinstance(access_token, str) or not access_token.strip():
         return headers
     try:
@@ -83,10 +75,6 @@ def apply_required_codex_headers(
     required_names = {name.lower() for name in required}
     existing = client_kwargs.get("default_headers") or {}
     client_kwargs["default_headers"] = {
-        **{
-            name: value
-            for name, value in existing.items()
-            if str(name).lower() not in required_names
-        },
+        **{name: value for name, value in existing.items() if str(name).lower() not in required_names},
         **required,
     }