[codex] allow CCA image generation and web search extensions (#29909)

## Summary

- allow the standalone image-generation and web-search extensions for
the actor-authorized provider shape used by CCA
- preserve builtin `image_generation` and `web_search` for older models
and existing flows
- keep ordinary non-OpenAI providers excluded from both extensions
- remove only the image extension local managed-AuthManager requirement
that CCA cannot satisfy
- share actor-authorization detection through `ModelProviderInfo`
- keep Core tests focused on routing behavior and cover header-shape
edge cases in `model-provider-info`
- add a Responses Lite regression that verifies both
`image_gen.imagegen` and `web.run`

## Why

CCA uses a provider named `local` with `requires_openai_auth: false` and
a non-empty `x-openai-actor-authorization` header. Core accepts that
provider shape, but both extension provider-name gates rejected it;
image generation additionally required a Codex-managed login.

The standalone paths must coexist with existing builtin tools. New
Responses Lite models can receive `image_gen.imagegen` and `web.run`,
while older models continue using builtin tools.

## Impact

This enables both standalone extensions for CCA once installed
downstream, without removing or changing builtin-tool compatibility for
older models.

## Validation

- `just test -p codex-core
responses_lite_exposes_standalone_tools_for_actor_authorized_provider`
- `just test -p codex-core
responses_lite_uses_standalone_web_search_and_image_generation`
- `just test -p codex-core
hosted_tools_follow_provider_auth_model_and_config_gates`
- `just test -p codex-image-generation-extension`
- `just test -p codex-web-search-extension`
- `just test -p codex-model-provider-info`
- `just fmt`
- `git diff --check`

codex-rs/core/src/tools/spec_plan.rs

@@ -98,7 +98,6 @@ use tracing::warn;
 const MULTI_AGENT_V2_NAMESPACE_DESCRIPTION: &str = "Tools for spawning and managing sub-agents.";
 const IMAGE_GEN_NAMESPACE: &str = "image_gen";
 const IMAGEGEN_TOOL_NAME: &str = "imagegen";
-const ACTOR_AUTHORIZATION_HEADER: &str = "x-openai-actor-authorization";
 
 type PlannedRuntime = Arc<dyn CoreToolRuntime>;
 
@@ -387,7 +386,10 @@ fn image_generation_tool_enabled(turn_context: &TurnContext) -> bool {
 }
 
 fn image_generation_runtime_enabled(turn_context: &TurnContext) -> bool {
-    (provider_uses_actor_authorization(turn_context)
+    (turn_context
+        .provider
+        .info()
+        .uses_openai_actor_authorization()
         || (turn_context.provider.info().requires_openai_auth
             && turn_context
                 .auth_manager
@@ -400,16 +402,6 @@ fn image_generation_runtime_enabled(turn_context: &TurnContext) -> bool {
             .contains(&InputModality::Image)
 }
 
-fn provider_uses_actor_authorization(turn_context: &TurnContext) -> bool {
-    let provider_info = turn_context.provider.info();
-    !provider_info.requires_openai_auth
-        && provider_info.http_headers.as_ref().is_some_and(|headers| {
-            headers.iter().any(|(name, value)| {
-                name.eq_ignore_ascii_case(ACTOR_AUTHORIZATION_HEADER) && !value.trim().is_empty()
-            })
-        })
-}
-
 fn standalone_image_generation_model_visible(turn_context: &TurnContext) -> bool {
     if !image_generation_runtime_enabled(turn_context) || !namespace_tools_enabled(turn_context) {
         return false;