Stage 1B: HTTP-level black-box characterization harness for the Gateway

[NOirBRight]

Part of #448

Problem

test_routing.py (30,372 lines) exercises CodexProxyHandler through private methods (_write_sse_event, _relay_official_passthrough_sse_response, ...). This pins the handler's internal shape: no decomposition of codex_proxy.py can proceed while a third of the test corpus depends on implementation details. Before any migration, the Gateway needs a behavior floor at its true interface: HTTP in, HTTP/SSE out.

Outcome

An in-process (or loopback) harness that drives the production Gateway as a black box:

• Start the Gateway with a test-scoped settings/providers fixture; issue real POST /v1/responses, POST /v1/chat/completions, GET /v1/models, GET /health requests; capture full response bodies and ordered SSE event streams.
• Upstreams are stub HTTP servers speaking Responses / Chat Completions (reuse existing fixtures where possible) — no live providers.
• Deterministic assertion helpers for SSE lifecycles (ordered events, exactly-one terminal event) reusable by later migrated tests.
• A starter characterization suite covering the highest-traffic behaviors: route selection official/external, streaming + non-streaming happy path, one protocol-translation path (Responses client → Chat upstream), normalized error classes, cancellation.

Non-goals

• Migrating test_routing.py content (Stage 2A).
• Changing any production code paths.

Acceptance criteria

• Harness runs in the standard pytest invocation on Windows and Linux (no Windows-only primitives).
• Starter suite green against current main with zero production diffs.
• Harness helpers documented so Stage 2A tranches can adopt them mechanically.
• Verification-policy gains the rule: new or migrated tests must not import private members of CodexProxyHandler / codex_proxy internals (Stage 1D, same PR or linked PR).

Verification class

Standard (test infrastructure; no production contract change). Python core suite once at candidate.

[NOirBRight]

Implementation candidate on feat/issue-449-gateway-harness SHA 89a9192.

• tests/gateway_harness/: in-process Gateway + stub upstream, SSE helpers, HTTP client.
• tests/test_gateway_characterization.py: health, models, official/external route selection, streaming + non-streaming, Responses→Chat, 429 class, identity failure before upstream I/O, cancellation.
• Result: 10 passed.
• docs/agents/verification-policy.md now includes Test seam discipline (Stage 1D).

No production code changes.