Forward Codex compute residency headers

[alphastorm]

Fixes #287.

Problem

fx sends ChatGPT subscription credentials directly to the Codex model and response endpoints, but drops the namespaced chatgpt_compute_residency claim. Region-constrained Enterprise and Edu workspaces can be rejected despite valid OAuth credentials.

Change

• Decode bounded compute residency alongside the existing ChatGPT account ID.
• Omit missing, no_constraint, malformed, control-bearing, and oversized values.
• Forward x-openai-internal-codex-residency on both /models and /responses requests.
• Keep ChatGPT credentials and residency metadata off Vercel AI Gateway traffic.
• Cover claim semantics, model discovery, response/tool loops, refresh-safe ownership, and origin isolation.

chatgpt_data_residency is intentionally ignored because it describes storage at rest; inference routing follows chatgpt_compute_residency, matching anomalyco/opencode#42432.

Verification

Exact head: 6789c0552c3e0d32dd16e317c64899c2c95bf8dc

• zig fmt --check src/
• zig build
• ZDOTDIR=/tmp/fx-empty-zdot zig build test
• Focused response E2E: 1 pass, 0 fail
• Focused ACP model-catalog E2E: 1 pass, 0 fail
• Built ./zig-out/bin/fx smoke against loopback model and response endpoints: both received compute residency us from a token containing data residency eu; process exit 0 and stderr empty
• Full CI: all four Full suite aggregates passed on the exact head
• Final ship gate: SHIP

Required label: type: bug. The contributor cannot apply repository labels.