fix(codex): restore reasoning-object whitelist deleted by #13717

[HouMinXi]

Summary

Restores the Codex reasoning-object key whitelist from #13643, which #13717 (e7999c477b) deleted. Unknown OpenRouter-style keys (enabled, max_tokens, ...) are stripped before the Responses API wire.

Conflict with current tip: keep the post-#13643 force-rule (getForcedReasoningEffort still wins) and keep enabled: false as a connection-default override. File-size freeze for open-sse/executors/codex.ts moved 1530 -> 1552 with a restore note.

Related to #14062. #14062 stays open.

Test plan

• tests/unit/codex-reasoning-wire-whitelist.test.ts: 8/8.
• Defect injection: hard-code clientDisabledReasoning = false -> 2 fail; restore -> 8/8.
• npm run typecheck:core: clean.

---

⚠️ base-red inherited: #13866 — the 16 unit-test failures reproduce on the clean tip 7cc454d9 (6/6 sampled) and are identical across PRs with disjoint content; none touches what this PR changes.

[diegosouzapw]

Reviewed. The restore itself is correct and clean — I diffed your head against the current tip and the only change to codex.ts is the isolated whitelist + clientDisabledReasoning re-addition; every legitimate change that landed on codex.ts after the original #13643 (the getForcedReasoningEffort precedence from #13556, stripCodexPassthroughRejectedParams, the WS onclose hardening) is intact. All 8 new tests pass, and I re-ran 70 pre-existing Codex executor tests plus typecheck:core — all clean.

One concrete issue that will fail CI's file-size gate: the config/quality/file-size-baseline.json update sets open-sse/executors/codex.ts to 1552, but the gate script counts lines via content.split("\n").length (which is wc -l + 1 for a file with a trailing newline), so it actually measures 1553. Please bump both entries (and the 1530->1552 note) to 1553 — that's the only outstanding item; I'll re-check once it's pushed.

Separately, flagging for coordination rather than as something to fix here: #13224 rewrites this same block into a new applyCodexReasoningSelection() helper that spreads the raw client reasoning object without a key whitelist, so if it merges after this without picking up the fix, the OpenRouter-key 400 comes back a third time. I'll note this on that PR's review too.