fix(codex): use default SDK HTTP transport

[Nevmen13]

Summary

Use the OpenAI SDK's default HTTP transport for the ChatGPT Codex backend instead of injecting Hermes' custom httpx.Client.

Problem

On Windows, Hermes v0.19.0 with valid ChatGPT OAuth credentials consistently received an immediate Cloudflare challenge:

HTTP 403 — HTML error page (title not found)

The same account and network worked in the official Codex client. Authentication, model selection, IPv4/IPv6, and HTTP/2 were ruled out.

PR #58766 removed the old socket-options transport, but the remaining explicitly constructed httpx.Client / HTTPTransport still triggered the Codex edge challenge on this setup.

Fix

For chatgpt.com, do not inject Hermes' keepalive client. The OpenAI SDK creates its default transport instead. Other providers retain the existing pool-level keepalive behavior.

This restores the narrow Codex bypass proposed in #12953, which was closed after #58766 was expected to remove the full failure class.

Validation

Live A/B test on Windows:

• Before: every native openai-codex request returned Cloudflare HTML 403.
• After: the same OAuth credentials, model, network, and prompt returned a normal response.
• Switching back to the injected transport reproduced the 403.

Targeted tests:

15 passed in 11.83s

Tests cover proxy routing, NO_PROXY, client lifecycle/reuse, kwargs isolation, and the new Codex default-transport regression.

Related: #12952, #12953, #58766

[teknium1]

Thanks for the focused Codex transport regression fix. Static review confirms that current main still unconditionally injects Hermes' keepalive client when http_client is absent (agent/agent_runtime_helpers.py:2070-2075), and the bundled openai-codex profile targets https://chatgpt.com/backend-api/codex (plugins/model-providers/openai-codex/__init__.py:6-12). The PR's chatgpt.com exception therefore changes a behavior that remains present on HEAD while preserving the normal injection path for other endpoints.

No blocking code issue was found in the submitted two-file diff. GitHub currently marks the branch dirty, but the production change is a small, localized adaptation to the current create_openai_client helper.

Automated hermes-sweeper review.