fix: honor configured base URL for openai-codex

[robinbraemer]

Summary

• honor model.base_url for openai-codex runtime resolution when model.provider is openai-codex
• apply the override for credential-pool, explicit, and singleton Codex auth paths
• add regression coverage for pool and singleton auth resolution

Why

openai-codex already resolves to the Codex Responses API, but runtime resolution fell back to DEFAULT_CODEX_BASE_URL even when users explicitly configured a Codex-compatible local/proxy endpoint in config.yaml. This prevented the standard Hermes runtime from using local Codex-compatible relays while keeping normal gateway/session behavior.

The override is scoped to configs where model.provider == openai-codex, and explicit/pool entry URLs still take precedence.

Test

• uv run --with pytest python -m pytest tests/hermes_cli/test_runtime_provider_resolution.py -q

[robinbraemer]

Closing as duplicate of #40924 / #40913 per the contribution guide's search-first guidance. I left the live verification details and model.base_url regression coverage on #40924.