fix(core): switch OpenAI credential routes atomically

[major]

Issue for this PR

Closes #45334

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Resolve the active OpenAI credential and transport together for each model request instead of relying on asynchronously refreshed provider state. ChatGPT OAuth requests always use the Codex endpoint and headers, while OpenAI API-key requests use the normal configured API endpoint without Codex headers.

Persist non-secret route provenance with assistant messages so OpenAI item IDs and encrypted reasoning from ChatGPT Codex are not replayed to the OpenAI API after an account switch. Visible reasoning and tool content remain available.

How did you verify your code works?

• bun test test/plugin/provider-openai.test.ts test/session-runner-message.test.ts test/session-message-update.test.ts from packages/core: 34 passed.
• bun typecheck from packages/core, packages/schema, packages/protocol, and packages/client: passed.
• bun run build from packages/core: passed.
• bun run generate from packages/client: passed.
• Prettier check for all changed files and git diff --check: passed.
• The full Core suite exceeded the local two-minute command limit in the unrelated filesystem watcher test. The focused regression tests above passed after rebasing onto current v2.

Screenshots / recordings

Not applicable.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.