[codex] fix(auth): harden OAuth refresh and Codex CLI bootstrap flows (#68396)

* Harden OAuth refresh and Codex CLI bootstrap flows

- Treat near-expiry OAuth credentials as unusable for bootstrap and refresh
- Add clearer timeout and callback validation handling for OpenAI Codex OAuth
- Tighten file lock retry behavior for stale OAuth refresh contention

* fix(auth): address PR review threads

* fix(auth): adopt fresher imported refresh tokens

* test(auth): align oauth expiry fixtures with refresh margin

* fix(auth): tighten Codex OAuth bootstrap and local fallback

* Keep explicit local auth over CLI bootstrap

- Preserve existing non-OAuth local profiles during external CLI OAuth sync
- Add regression coverage for OpenAI Codex and generic external OAuth overlays

* fix(auth): distinguish oauth lock timeout sources

* fix(auth): reject cross-account external oauth bootstrap

* fix(auth): narrow refresh contention classification

docs/.generated/plugin-sdk-api-baseline.sha256

@@ -1,2 +1,2 @@
-e5c3d6eb56304164434a8b29670a6f02490f359eb7a5f3f4034e61a1b8421c54  plugin-sdk-api-baseline.json
-14d07997a35902bbd3c94d528aafa53185bc66a0ddd9b518f87c85a352feb476  plugin-sdk-api-baseline.jsonl
+d08f0e793e66192fdbc377183ce0d94adcbec53cf334522bce8c0c457b90b0a8  plugin-sdk-api-baseline.json
+924f20b350a9f1997e95b3d7249cbb6720c9576c63e6c0c15cca0164734fd93d  plugin-sdk-api-baseline.jsonl