fix: only send reasoning.encrypted_content include for supported models

[ambition0802]

Description

Prevent HTTP 400 errors when using OpenAI models that don't support encrypted reasoning content (e.g., gpt-4o, gpt-4o-mini) with the Responses API.

The codex transport and auxiliary client previously sent include=["reasoning.encrypted_content"] unconditionally for all non-xAI, non-GitHub models. However, only o-series (o1, o3) and gpt-5 models support this parameter. GPT-4o, GPT-4o-mini, and older models reject it with:

Encrypted content is not supported with this model

Changes Made

1. agent/model_metadata.py: Added openai_supports_encrypted_content() function to check if a model supports the encrypted reasoning content parameter. Uses an allowlist approach (conservative - only known-supported models get the parameter).

2. agent/transports/codex.py: Updated to only send the include parameter for models that support encrypted content. Also removed include=[] when reasoning is disabled to avoid potential issues with some models.

3. agent/auxiliary_client.py: Updated the auxiliary client's codex completions adapter with the same check.

4. tests/agent/test_encrypted_content_support.py: Added test coverage for the new function.

Fixes

#23450

Testing

• All unit tests for openai_supports_encrypted_content() pass
• Verified the function correctly identifies supported models (gpt-5, o1, o3) and unsupported models (gpt-4o, gpt-4o-mini, etc.)
• The allowlist approach ensures future models that don't support this parameter won't break

Checklist

• Code follows the project style guidelines
• Tests have been added or updated
• Documentation has been updated if needed
• All existing tests pass

[alt-glitch]

Competing fix for #23450 — see also PR #23460 which takes a simpler approach (removes include entirely for non-xAI/non-GitHub). This PR uses an allowlist approach (only sends include for o-series/gpt-5). Maintainers should pick one.

[teknium1]

Thanks for tracing both the main and auxiliary Responses call paths. The direct-OpenAI premise remains valid on current main: hermes_cli/runtime_provider.py:120-121 routes api.openai.com to codex_responses, while agent/transports/codex.py:282-293 still emits reasoning.encrypted_content for non-xAI/non-GitHub reasoning requests.

Problems

• tests/agent/test_encrypted_content_support.py tests only the helper. It does not exercise either changed request builder: agent/transports/codex.py:282-293 or agent/auxiliary_client.py:911-936.
• Current main has replay-aware encrypted-content handling: agent/conversation_loop.py:2860-2901 disables replay only after a rejected stored reasoning blob. The salvage needs coverage that the model capability gate preserves this behavior.

Suggested changes

• Add captured-payload tests for supported and GPT-4o-family models through both request-building paths, asserting the final include field is present or absent as intended.
• Add a replay-disabled regression case alongside those payload tests.

Automated hermes-sweeper review.

[teknium1]

This covers only the pure capability helper. Please add captured-payload tests for both changed callers—ResponsesApiTransport.build_kwargs() and _CodexCompletionsAdapter.create()—so GPT-4o-family requests are proven to omit include on the actual wire kwargs.