Use the shared HTTP client in codex-protocol (#36033)

## What changed

- Replace direct `reqwest` error types in `codex-protocol` with
  `codex_http_client::HttpError`.
- Build the response-stream error test through
  `codex_http_client::HttpResponse`.
- Remove `codex-protocol` from the direct `reqwest` dependency allowlist.

## Testing

- Update the response-stream failure test to cover status and URL propagation
  through the shared HTTP response wrapper.

GitOrigin-RevId: 7abcbbe55f994acb13cccefef806a53c7008acde

codex-rs/protocol/src/error_tests.rs

@@ -5,12 +5,10 @@ use chrono::DateTime;
 use chrono::Duration as ChronoDuration;
 use chrono::TimeZone;
 use chrono::Utc;
-use http::Response as HttpResponse;
+use codex_http_client::HttpResponse;
+use http::Response as RawHttpResponse;
+use http::StatusCode;
 use pretty_assertions::assert_eq;
-use reqwest::Response;
-use reqwest::ResponseBuilderExt;
-use reqwest::StatusCode;
-use reqwest::Url;
 use std::time::Duration;
 
 #[test]
@@ -224,12 +222,14 @@ fn sandbox_denied_reports_stdout_when_no_stderr() {
 
 #[test]
 fn to_error_event_handles_response_stream_failed() {
-    let response = HttpResponse::builder()
+    let response = RawHttpResponse::builder()
         .status(StatusCode::TOO_MANY_REQUESTS)
-        .url(Url::parse("http://example.com").unwrap())
         .body("")
         .unwrap();
-    let source = Response::from(response).error_for_status_ref().unwrap_err();
+    let source = HttpResponse::from(response)
+        .error_for_status_ref()
+        .unwrap_err()
+        .with_url("http://example.com".parse().unwrap());
     let err = CodexErr::ResponseStreamFailed(ResponseStreamFailed {
         source,
         request_id: Some("req-123".to_string()),