Migrate agent identity to the shared HTTP client (#34631)

## Why

`codex-http-client` is the intended owner of direct `reqwest` usage.

## What changed

- Route agent identity registration, task registration, and JWKS requests through `HttpClient`.
- Preserve retry classification using `HttpError` and `http::StatusCode`.
- Remove `codex-agent-identity` from the temporary direct-`reqwest` dependency exceptions.

GitOrigin-RevId: 7445c9f2521e6d8ef0969a1483c81f797bf91316

codex-rs/login/src/auth/agent_identity.rs

@@ -14,11 +14,12 @@ use codex_agent_identity::is_retryable_registration_error;
 use codex_agent_identity::public_key_ssh_from_private_key_pkcs8_base64;
 use codex_agent_identity::register_agent_identity;
 use codex_agent_identity::register_agent_task;
+use codex_http_client::HttpClient;
 use codex_protocol::account::PlanType as AccountPlanType;
 use codex_protocol::protocol::SessionSource;
 use thiserror::Error;
 
-use crate::default_client::build_default_auth_reqwest_client;
+use crate::default_client::create_default_auth_client;
 use crate::outbound_proxy::AuthRouteConfig;
 
 use super::storage::AgentIdentityAuthRecord;
@@ -178,7 +179,7 @@ pub(super) async fn register_managed_chatgpt_agent_identity(
 ) -> std::io::Result<AgentIdentityAuth> {
     let key_material = generate_agent_key_material().map_err(std::io::Error::other)?;
     let registration_url = agent_registration_url(agent_identity_authapi_base_url);
-    let client = build_default_auth_reqwest_client(&registration_url, auth_route_config)?;
+    let client = create_default_auth_client(&registration_url, auth_route_config)?;
     let runtime_id = retry_registration(|| async {
         register_agent_identity(
             &client,
@@ -225,7 +226,7 @@ pub(super) async fn verified_record_from_jwt(
 ) -> std::io::Result<AgentIdentityAuthRecord> {
     AgentIdentityAuthRecord::from_agent_identity_jwt(jwt)?;
     let jwks_url = agent_identity_jwks_url(chatgpt_base_url);
-    let client = build_default_auth_reqwest_client(&jwks_url, auth_route_config)?;
+    let client = create_default_auth_client(&jwks_url, auth_route_config)?;
     let jwks = fetch_agent_identity_jwks(&client, chatgpt_base_url)
         .await
         .map_err(std::io::Error::other)?;
@@ -305,7 +306,7 @@ async fn register_task_for_record_with_retries(
 ) -> std::io::Result<String> {
     let task_registration_url =
         agent_task_registration_url(agent_identity_authapi_base_url, &record.agent_runtime_id);
-    let client = build_default_auth_reqwest_client(&task_registration_url, auth_route_config)?;
+    let client = create_default_auth_client(&task_registration_url, auth_route_config)?;
     retry_registration(|| async {
         register_task_for_record(&client, record, agent_identity_authapi_base_url).await
     })
@@ -313,7 +314,7 @@ async fn register_task_for_record_with_retries(
 }
 
 async fn register_task_for_record(
-    client: &reqwest::Client,
+    client: &HttpClient,
     record: &AgentIdentityAuthRecord,
     agent_identity_authapi_base_url: &str,
 ) -> std::io::Result<String> {