core: route Responses API through system proxy

[bolinfest]

Why

features.respect_system_proxy already routes authentication traffic through the OS proxy APIs, but it does not affect the primary inference path. That leaves users behind OS-managed proxies unable to send normal Responses API requests even after login succeeds.

This PR is the first product-path migration onto the route-aware transport introduced in #31323 and refined in #31331. It also establishes the construction pattern for later migrations: the effective feature state is resolved once into a required HTTP client factory rather than represented by an optional per-call setting.

The scope remains limited to the two HTTP Responses endpoints; WebSockets, model discovery, memories, realtime, and file uploads remain follow-up migrations.

What changed

• Replace the optional proxy marker with an explicit OutboundProxyPolicy::{ReqwestDefault, RespectSystemProxy} and a required HttpClientFactory. The policy has no default, and the lower-level route-aware reqwest builder is now private.
• Have Config construct the factory from the effective feature state and require every ModelClient constructor to receive it. There is no optional setter or implicit None fallback.
• Build HTTP clients for /responses and /responses/compact with ClientRouteClass::Api, using the complete destination URL so PAC rules can make URL-specific decisions.
• Layer route-aware selection onto Codex's existing default headers, Cloudflare cookie store, custom CA handling, and sandbox no-proxy behavior.
• Extend config coverage to assert that enabling the feature produces a factory with OutboundProxyPolicy::RespectSystemProxy.

Review guide

1. http-client/src/outbound_proxy.rs defines the mandatory policy/factory boundary and keeps route resolution private.
2. core/src/config/mod.rs, core/src/session/session.rs, and core/src/client.rs show the compile-time invariant: effective config creates the factory, and ModelClient cannot be constructed without one.
3. login/src/auth/default_client.rs preserves existing default-client behavior while accepting the required factory for migrated routes.
4. core/src/client.rs switches only streaming Responses and remote compaction HTTP transports to the API route class.
5. core/src/config/config_tests.rs covers feature-to-factory resolution; http-client/src/outbound_proxy_tests.rs covers routing through an environment-selected proxy.

Test plan

• cargo check --tests -p codex-http-client -p codex-login -p codex-core
• just test -p codex-login
• just test -p codex-core respect_system_proxy_feature_resolves_enabled
• Existing compact_uses_bearer_after_agent_identity_session_fallback coverage passes with the new transport construction.
• just bazel-lock-check

---

Stack created with Sapling. Best reviewed with ReviewStack.

• http-client: expose WebSocket proxy prerequisites #31342
• -> core: route Responses API through system proxy #31335

[anp-oai]

Don't need to address here but this seems like something we'll need to reconcile before we make respect_system_proxy the default