fix(auth): fall back from empty codex profile state

[sweetcornna]

Summary

• let profile-mode openai-codex provider state fall back to global auth when local tokens are empty or unusable
• reuse credential-pool profile/global fallback when resolving Codex runtime pool credentials
• add profile fallback regressions for empty Codex singleton state and global pool fallback

Scope

This addresses the credential-store shadowing part of #38261. The stale worker credential lifecycle described there is a separate launchd/gateway worker restart problem and is intentionally left for a follow-up lifecycle/docs change.

Addresses #38261.

Verification

• /Users/cornna/project/hermes-agent/.venv/bin/python -m pytest tests/hermes_cli/test_auth_profile_fallback.py::test_load_provider_state_codex_empty_tokens_falls_back_to_global tests/hermes_cli/test_auth_profile_fallback.py::test_load_provider_state_codex_profile_valid_tokens_shadow_global tests/hermes_cli/test_auth_profile_fallback.py::test_resolve_codex_runtime_credentials_profile_empty_provider_uses_global_pool -q
• /Users/cornna/project/hermes-agent/.venv/bin/python -m pytest tests/hermes_cli/test_auth_profile_fallback.py tests/hermes_cli/test_auth_codex_provider.py tests/hermes_cli/test_runtime_provider_resolution.py -q
• /Users/cornna/project/hermes-agent/.venv/bin/python -m ruff check hermes_cli/auth.py tests/hermes_cli/test_auth_profile_fallback.py
• git diff --check

[teknium1]

Thanks for narrowing this to the credential-store shadowing path. The current-main inspection confirms the reported gap: an empty profile singleton shadows global state, while the Codex pool fallback reads only the profile pool.

Problems

• hermes_cli/auth.py:1157 returns a global Codex state without preserving its source store. A later refresh reaches _save_codex_tokens, which reloads and writes the active profile store (hermes_cli/auth.py:3386-3407), leaving the global source stale. Current main’s Nous path uses _load_provider_state_with_source / _save_provider_state_to_source for this cross-store rotation case (hermes_cli/auth.py:1177-1252).
• The added tests do not force a refresh of a global fallback state, so they do not cover that persistence invariant.

Suggested changes

• Salvage this against the source-aware helper on current main and write refreshed Codex grants back to the store they were read from.
• Add a profile/global forced-refresh regression asserting global rotation and no unintended profile shadowing.

Automated hermes-sweeper review.

[teknium1]

This fallback loses the auth-store source. If the returned global token is expiring, the Codex refresh path later saves via _save_codex_tokens to the active profile store, leaving the global grant stale. Please carry the selected source path through refresh and persist back to that source, following current main’s _load_provider_state_with_source / _save_provider_state_to_source pattern.