fix(agent): sanitize Codex tool-call history summaries

[teknium1]

Salvage of #17645 (@stephenschoettler) onto current main — the original branch was 154 commits behind and CI had been failing on base-suite regressions addressed separately by #17660 (already merged).

Codex/OpenAI Responses sessions no longer 400 on the final max-iterations summary with 'No tool call found for function call output with call_id …'.

Changes

• agent/context_compressor.py: _get_tool_call_id prefers call_id over id.
• run_agent.py: _get_tool_call_id_static matches. _handle_max_iterations now runs _sanitize_api_messages before the summary call (same safety net as the main loop).
• Tests: 3 new cases covering the id-mismatch repair and the summary-path orphan strip.

Root cause

Codex Responses tool_calls carry both id (an fc_* response-item id used for streaming correlation) and call_id (the call_* id the API expects in function_call_output.call_id and that we persist into tool_call_id on tool results). The sanitizer built surviving_call_ids from tc.id, so every Codex tool result looked orphaned — either the result got dropped or a stub was inserted with the wrong id, leaving the real call_* output unpaired. Chat-completions tool_calls only have id (no call_id), so the fallback keeps that path unchanged.

Validation

• tests/agent/test_context_compressor.py + tests/run_agent/test_run_agent.py: 375/375 passing.
• The 3 new tests pass individually.

Credit: @stephenschoettler. Closes #17645.