fix(auth): preserve named-provider headers in auxiliary calls

[azilko]

Summary

• preserve the Codex User-Agent and originator headers when a named custom provider targets chatgpt.com
• apply providers.<name>.extra_headers to the auxiliary OpenAI client, matching the main-agent construction path
• keep header precedence explicit: host defaults, global user defaults, then provider-specific headers

Why

Named custom providers already support command-backed credentials, and the main runtime applies both Codex host headers and provider-specific headers. The auxiliary named-provider branch did neither. A provider could therefore work for normal turns while title generation, compression, vision, or other auxiliary calls failed with 401/403 responses.

Header values are never logged.

Tests

• scripts/run_tests.sh tests/agent/test_auxiliary_named_custom_providers.py tests/agent/test_auxiliary_user_default_headers.py tests/agent/test_codex_cloudflare_headers.py -q — 32 passed
• python -m ruff check agent/auxiliary_client.py tests/agent/test_auxiliary_named_custom_providers.py — clean
• git diff --check upstream/main...HEAD — clean

Overlap and exact delta

Open PRs #61346, #84223, and #88474 cover adjacent named-provider header plumbing. This draft should be reviewed as the narrower auxiliary Codex-host follow-up: it adds the ChatGPT/Codex User-Agent and originator defaults and makes the auxiliary precedence chain explicit (host defaults, global user defaults, provider-specific headers). If an older auxiliary PR lands first, this branch should be rebased and reduced to that remaining delta.

[alt-glitch]

This was generated by AI during triage.

Related: this overlaps the active auxiliary-header fixes #61346, #84223, and #88474. This PR additionally handles ChatGPT/Codex host defaults in the named-provider construction path; reviewers should consolidate the overlapping routes.

[azilko]

Thanks — agreed on the overlap. #91156 was intentionally scoped to the current command-backed named-provider path on chatgpt.com, including the Codex host defaults (User-Agent and originator) in addition to the selected provider's extra_headers.

I'm happy to consolidate that hunk and its command-backed Codex regression test into whichever generic auxiliary-header PR maintainers select. Of the linked implementations, #84223 appears to provide the broadest named-identity and async coverage; the Codex-specific test here can complement it by pinning the key_cmd + codex_responses + ChatGPT-host behavior.

[azilko]

Overlap audit against the three older open PRs:

• fix(agent): apply named custom provider extra_headers to auxiliary clients #61346 applies named custom-provider extra_headers to the main agent client.
• fix(aux): preserve named provider headers in auxiliary clients #84223 and fix(auxiliary): thread named-custom extra_headers to aux clients and probes #88474 cover related auxiliary/custom-provider header plumbing.
• This draft's remaining distinct behavior is the Codex/ChatGPT host default (User-Agent and originator) plus an explicit precedence chain for auxiliary calls: host defaults, global user defaults, then provider-specific headers.

So this should not be merged as though the whole header-plumbing premise were novel. I have narrowed the PR description to call out the overlap and the exact delta. If one of the older auxiliary PRs lands first, I will rebase and retain only the missing Codex-host default/precedence behavior and its tests.