fix(codex): bound cache keys at provider boundaries

[teknium1]

Summary

Provider-facing Codex/Responses cache-routing keys are now bounded at every mutable boundary, including after request middleware.

Changes

• Hash over-length session_id / x-client-request-id cache-scope headers while preserving short IDs and unrelated caller headers.
• Bound explicit top-level and xAI extra_body.prompt_cache_key overrides.
• Reapply the guard in final preflight_kwargs() so execution middleware cannot reintroduce an oversized key immediately before the provider call.
• Cover the 64/65-character boundary, deterministic hashing, collision resistance, caller headers, body/header parity, xAI overrides, and a full middleware-to-dispatch path.

This preserves @webtecnica's #66272 commit authorship, folds in the broader provider-boundary design from #62349 by @thegoodguysla, credits @Armib20's earliest #24273 submission, and follows @gracejudy's live diagnosis that isolated the production failure to the cache-scope headers.

Validation

• tests/agent/transports/test_codex_transport.py
• tests/run_agent/test_run_agent_codex_responses.py
• 186 targeted tests passed
• Ruff and git diff --check passed
• Real-import probe verified Codex header, top-level, and xAI body keys remain ≤64 after late mutation

Fixes #66045.

Infographic

[alt-glitch]

This was generated by AI during triage.

Related to #24273 and #62349: this PR also bounds override keys at final preflight, so it has broader provider-boundary scope than the existing open repairs. Please consolidate the cache-key contract.

[tonydwb]

Code Review Summary

Verdict: Approved

Clean, well-scoped change with good test coverage. No security concerns.

---

Reviewed by Hermes Agent