fix(auth): keep manual Codex pool entries isolated

[yeyitech]

Summary

• restrict _sync_codex_entry_from_cli() so only the singleton device_code entry can sync from ~/.codex/auth.json
• keep manual manual:device_code pool entries isolated from the shared Codex CLI token store
• add a regression test proving manual pool entries remain untouched while the singleton entry refreshes

Closes #11364.

Testing

• PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 python -m pytest -o addopts= tests/agent/test_credential_pool.py -q

[alt-glitch]

Related to #11727 and #9173 — all address _sync_codex_entry_from_cli overwriting manual pool entries. Closed #12924 was an earlier attempt at the same fix.

[teknium1]

Thanks for the careful fix and regression test, @yeyitech! This is a well-reasoned narrower guard.

However, this PR can no longer be merged — the function it patches (_sync_codex_entry_from_cli) was removed entirely from agent/credential_pool.py by PR #12360 (merged 2026-04-18, one day after this PR was opened). That PR took Option C from issue #11364: removing the ~/.codex/auth.json runtime sync path entirely, so Hermes now owns its Codex auth state end-to-end and never reads from ~/.codex/auth.json at runtime.

• Implementing commit: b02833f32d4b22d989c668a0d6cb2f1cf3b57f75 (fix(codex): Hermes owns its own Codex auth; stop touching ~/.codex/auth.json)
• Referenced issue openai-codex credential pool: _sync_codex_entry_from_cli overwrites all entries with the same token #11364 is closed
• Earlier attempt PR Fix Codex CLI sync clobbering manual pool entries #12924 is also closed

The underlying bug this PR addresses is resolved. Closing as implemented on main.

This is an automated hermes-sweeper review.