feat(codex): support caller-owned turn attribution - #1003

Description

Add caller-owned Codex turn attribution through provider_options[:codex_turn_metadata], alongside the existing session_id and thread_id options.

• Validate turn/window identity, request kind, Unix start time, and optional installation identity.
• Project the same identity into canonical client_metadata and attribution headers across buffered HTTP, SSE, and WebSocket requests.
• Put attribution on every response.create frame, including reused connections; expose validated identity in telemetry without replacing the per-call request ID.
• Normalize namespaced provider options when opening a Codex WebSocket session.

The application or agent runtime owns logical turns and retains their identity through tool continuations and retries. ReqLLM does not infer turns from messages, generate turn IDs, or change prompt-cache overrides. This repairs the client contract; it does not claim a change in private subscription quota policy.

Type of Change

• New feature (non-breaking change adding functionality)
• Bug fix (namespaced options in Codex session setup)
• Documentation update

Breaking Changes

None intended. Attribution is opt-in; existing session/cache behavior is unchanged when the new option is absent.

Testing

• mix test: 4,329 passed, 11 skipped, 175 excluded
• mix quality: passed
• Regression reproduced the unsupported option before implementation.
• Wire tests cover Spark, Responses Lite, and Astra across all three transports.
• A real local WebSocket test sends three requests on one connection, retaining then rotating the turn ID and checking each frame. It also reproduced the namespaced-session setup failure before the fix.
• LLMProxy downstream full CI passed against this implementation: 516 tests passed, 9 excluded.
• No live provider calls or fixture recording.

Checklist

• Code follows project style
• Documentation updated
• Regression tests added
• Tests and quality checks pass
• Conventional commit
• CHANGELOG.md untouched

Related Context

• Follows the session/cache compatibility work in fix(codex): preserve session and prompt cache identity across transports #996.
• Same attribution contract as fix(ai): add canonical Codex turn attribution earendil-works/pi#9488 and Align Pi with Codex's canonical turn-attribution metadata earendil-works/pi#9481.

AI-assisted implementation and PR description.

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}