fix(codex): drop transient rs_tmp reasoning replay state

[kpadilha]

What does this PR do?

Stops Hermes from persisting transient Codex reasoning replay items whose ids use the rs_tmp_* prefix.

These temporary blobs later contaminate replay state and can surface as invalid_encrypted_content failures. Hermes already has runtime recovery in another patch; this PR addresses the contamination at the source by avoiding persistence of the transient replay state in the first place.

Related Issue

No tracked issue. This PR complements existing Codex replay recovery work by preventing the bad transient state from being written.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• Updated _normalize_codex_response() to drop transient rs_tmp_* reasoning replay items.
• Preserved incomplete handling for reasoning-only responses even when the transient replay blob is skipped.
• Kept stable rs_* reasoning replay state intact.
• Added regression coverage in tests/run_agent/test_run_agent_codex_responses.py for:
  • transient drop
  • no-summary incomplete behavior
  • stable rs_* preservation

How to Test

1. Run:
   • python -m pytest -o addopts='' tests/run_agent/test_run_agent_codex_responses.py -q
2. Verify the targeted suite passes (47 passed locally when validated).
3. Confirm transient rs_tmp_* items are dropped while stable rs_* items are preserved.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Debian GNU/Linux 13 (trixie)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

Screenshots / Logs

python -m pytest -o addopts='' tests/run_agent/test_run_agent_codex_responses.py -q
47 passed

[teknium1]

Salvaged onto current main via #33146 (merged as b1a46b3). Your authorship is preserved in git log on the fix commit. Thanks @kpadilha — exactly the right prevention layer to pair with the recovery path that landed in #33035. Stops the contamination at the source instead of unwinding it after the HTTP 400.