fix(auth): share Codex and xAI OAuth state across profiles

[thunderfight127-svg]

Summary

• add a Hermes-owned shared OAuth store for OpenAI Codex tokens so named profiles import and refresh the same canonical ChatGPT token chain
• add shared xAI OAuth store handling for named profiles, including serialized refresh-token rotation and compare-and-clear protection on terminal refresh failures
• route xAI OAuth runtime credentials through the shared store and add regression coverage for cross-profile refresh behavior

Tests

• python -m py_compile agent/agent_init.py agent/credential_pool.py hermes_cli/auth.py hermes_cli/config.py
• python -m pytest tests/hermes_cli/test_auth_codex_provider.py tests/hermes_cli/test_auth_codex_self_heal.py tests/hermes_cli/test_auth_xai_oauth_provider.py tests/agent/test_credential_pool.py tests/agent/test_credential_pool_routing.py tests/tools/test_credential_pool_env_fallback.py -o 'addopts=' -q

[alt-glitch]

Related: #47290 (the author's earlier xAI-only attempt, now closed), and the competing Codex-sharing PRs #47221 and #28277 (both open). This PR combines shared Codex + xAI OAuth state across profiles in one change — maintainers should pick between this and the open Codex-only PRs.

[thunderfight127-svg]

Thanks for connecting the related PRs. This one intentionally supersedes my earlier xAI-only #47290 and bundles the Codex shared-store path with the xAI rotation fix so named profiles have one consistent OAuth-sharing behavior.

One extra difference from a Codex-only change is that xAI refresh tokens rotate, so this PR also serializes shared-store refresh and uses compare-and-clear on terminal refresh failures to avoid one profile deleting a token chain already rotated by another profile.

[alaamohanad169-ship-it]

Acknowledged: noted competing PR(s) #47290, #47221, #28277. My approach differs and is complementary, not mutually exclusive. Open to consolidating if reviewers prefer one direction.