fix(codex): classify content-filter incomplete responses as terminal refusals

[teknium1]

Summary

Codex Responses content-filter refusals (status="incomplete" + incomplete_details.reason="content_filter", typically with output=[]) are now classified as terminal finish_reason="content_filter" and routed through the existing content-policy refusal path — instead of falling into invalid-response retries plus 3 continuation attempts that end in the misleading "Codex response remained incomplete after 3 continuation attempts".

Salvages #55639 (@sk-holmes, fixes #55637) with authorship preserved. Chosen over duplicates #55682 (loop-only — misses the empty-output validation gap, so the refusal dies in invalid-response retries before its branch runs) and #55718 (adapter-only + unrelated STT change); @sk-holmes's was both first-submitted and the only one covering all three layers.

Changes (@sk-holmes)

• agent/transports/codex.py: validate_response accepts the empty-output content-filter shape as a valid terminal response so it reaches normalization; empty-output non-filter responses still fail validation
• agent/codex_responses_adapter.py: the refusal outranks every other finish reason; empty-output refusals synthesize an empty message instead of raising "no output items"
• agent/conversation_loop.py: the codex_responses status check maps the refusal to finish_reason="content_filter" (case-normalized), joining the existing refusal handling (ContentPolicyBlocked, provider fallback)

Validation

Shape	Before	After
incomplete + content_filter + output=[]	invalid-response retries → misleading error	terminal content_filter, refusal path + fallback
incomplete + content_filter + reasoning item (codex backend)	reasoning-only continuation ×3	terminal content_filter (refusal outranks)
incomplete + max_output_tokens	continuation	continuation (unchanged)
completed + output=[]	RuntimeError	RuntimeError (unchanged)

• scripts/run_tests.sh on adapter + transport + run_agent + codex_responses suites: 625/625 passed on current main (post-fix(codex): trust response.status for reasoning-only turns on unrecognized Responses backends #64764/fix(codex): rescue reasoning-only turns from the 3-attempt continuation death loop #64768)
• E2E with real imports: all four table rows plus dict-shaped incomplete_details verified

Infographic