Refresh Codex policy auth before native turns

[algoflows]

Related issue

N/A

Summary

• Refresh the short-lived bearer used by the Codex UserPromptSubmit policy hook immediately before each native Codex turn.
• Keep the last token if refreshing is temporarily unavailable, so a brief control-plane problem does not erase a credential that may still work.
• Cover both the credential helper and the real runner message-dispatch path.

ELI5: Codex could look online while rejecting every message because its internal security pass had gone stale after the server restarted. The runner now gives that security check a fresh pass before every message.

User message -> runner refreshes policy pass -> UserPromptSubmit policy check -> Codex turn

Test Plan

• pre-commit run --files omnigent/runner/app.py tests/runner/test_app_sessions_native.py
• pytest -q tests/test_codex_native_hook.py tests/e2e/test_managed_runner_http_auth.py tests/runner/test_app_sessions_native.py::test_codex_message_refreshes_policy_auth_before_harness_dispatch tests/runner/test_app_sessions_native.py::test_codex_policy_hook_snapshot_refreshes_before_turn tests/runner/test_app_sessions_native.py::test_codex_policy_hook_refresh_retains_snapshot_when_mint_fails tests/runner/test_app_sessions_native.py::test_claude_permission_hook_snapshot_refreshes_without_binding_token (17 passed)
• pre-commit run --all-files was also run. All backend checks passed; the existing frontend tree triggered unrelated Prettier rewrites, which are intentionally excluded from this backend fix.

Demo

N/A — non-visual runner authentication fix.

Type of change

• Bug fix
• Feature
• UI / frontend change
• Refactor / chore
• Docs
• Test / CI
• Breaking change

Test coverage

• Unit tests added / updated
• Integration tests added / updated
• E2E tests added / updated
• Manual verification completed
• Existing tests cover this change
• Not applicable

Coverage notes

The integration test submits a message through the real runner event endpoint and verifies the policy bearer is refreshed before the Codex harness receives the turn.

Changelog

Codex messages continue working after Omnigent restarts because their policy credentials are refreshed before each turn.

[algoflows]

CI note: the server-rest shard reports four failures, but all four reproduce unchanged on the current main commit (7bedbc87) when run directly:

• three session-snapshot assertions that do not yet account for the existing /models request;
• the pre-existing generated openapi.json drift.

This PR changes only omnigent/runner/app.py and its runner regression tests. Its focused auth suite passes (17 tests), the runner-app shard passes, and the security, pre-commit, Windows, Docker, and related integration checks are green. I am recording the baseline reproduction here so the admin merge decision is explicit and auditable.

[algoflows]

Additional CI note: the UI E2E failures are also outside this PR and reflect the Tellimer fork defaults versus upstream test expectations. The failures expect the default theme and navigation text to say Omnigent / System, while the fork intentionally renders Tellimer, Agent Platform, and the Tellimer theme. No web file is changed by this PR; the remaining Codex, runner, security, Docker, and backend matrices are unaffected.