[codex] Remove async_trait from first-party code (#27475)

## Why

First-party async traits should expose their `Send` contracts explicitly
without requiring `async_trait`. This completes the migration pattern
established in #27303 and #27304.

## What changed

- Replaced the remaining first-party `async_trait` traits with native
return-position `impl Future + Send` where statically dispatched and
explicit boxed `Send` futures where object safety is required.
- Kept implementations behavior-preserving, outlining existing async
bodies into inherent methods where that keeps the diff reviewable.
- Removed all direct first-party `async-trait` dependencies and the
workspace dependency declaration.
- Added a cargo-deny policy that permits `async-trait` only through the
remaining transitive wrapper crates.
- Updated `rand` from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097 and
keep the full cargo-deny check passing.

## Validation

- `just test -p codex-exec-server`: 216 passed, 2 skipped.
- `just test -p codex-model-provider`: 39 passed.
- `just test -p codex-core` and `just test`: changed tests passed;
remaining failures are environment-sensitive suites unrelated to this
migration.
- `cargo deny check`
- `just fix`
- `just fmt`
- `cargo shear`
- `just bazel-lock-check`

codex-rs/model-provider/src/amazon_bedrock/auth.rs

@@ -133,11 +133,6 @@ impl BedrockMantleSigV4AuthProvider {
     fn new(context: AwsAuthContext) -> Self {
         Self { context }
     }
-}
-
-#[async_trait::async_trait]
-impl AuthProvider for BedrockMantleSigV4AuthProvider {
-    fn add_auth_headers(&self, _headers: &mut HeaderMap) {}
 
     async fn apply_auth(&self, request: Request) -> std::result::Result<Request, AuthError> {
         let mut request = request;
@@ -162,6 +157,14 @@ impl AuthProvider for BedrockMantleSigV4AuthProvider {
     }
 }
 
+impl AuthProvider for BedrockMantleSigV4AuthProvider {
+    fn add_auth_headers(&self, _headers: &mut HeaderMap) {}
+
+    fn apply_auth(&self, request: Request) -> codex_api::AuthProviderFuture<'_> {
+        Box::pin(BedrockMantleSigV4AuthProvider::apply_auth(self, request))
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use codex_api::AuthProvider;

codex-rs/model-provider/src/amazon_bedrock/mod.rs

@@ -20,6 +20,7 @@ use codex_protocol::error::Result;
 use codex_protocol::openai_models::ModelsResponse;
 
 use crate::provider::ModelProvider;
+use crate::provider::ModelProviderFuture;
 use crate::provider::ProviderAccountResult;
 use crate::provider::ProviderAccountState;
 use crate::provider::ProviderCapabilities;
@@ -68,9 +69,32 @@ impl AmazonBedrockModelProvider {
                 | CodexAuth::PersonalAccessToken(_) => None,
             })
     }
+
+    async fn auth(&self) -> Option<CodexAuth> {
+        self.managed_auth().map(CodexAuth::BedrockApiKey)
+    }
+
+    async fn api_provider(&self) -> Result<Provider> {
+        let managed_auth = self.managed_auth();
+        let mut api_provider_info = self.info.clone();
+        api_provider_info.base_url =
+            Some(runtime_base_url(managed_auth.as_ref(), &self.aws).await?);
+        api_provider_info.to_api_provider(/*auth_mode*/ None)
+    }
+
+    async fn runtime_base_url(&self) -> Result<Option<String>> {
+        let managed_auth = self.managed_auth();
+        Ok(Some(
+            runtime_base_url(managed_auth.as_ref(), &self.aws).await?,
+        ))
+    }
+
+    async fn api_auth(&self) -> Result<SharedAuthProvider> {
+        let managed_auth = self.managed_auth();
+        resolve_provider_auth(managed_auth.as_ref(), &self.aws).await
+    }
 }
 
-#[async_trait::async_trait]
 impl ModelProvider for AmazonBedrockModelProvider {
     fn info(&self) -> &ModelProviderInfo {
         &self.info
@@ -101,8 +125,8 @@ impl ModelProvider for AmazonBedrockModelProvider {
             .and_then(|_| self.auth_manager.as_ref().cloned())
     }
 
-    async fn auth(&self) -> Option<CodexAuth> {
-        self.managed_auth().map(CodexAuth::BedrockApiKey)
+    fn auth(&self) -> ModelProviderFuture<'_, Option<CodexAuth>> {
+        Box::pin(AmazonBedrockModelProvider::auth(self))
     }
 
     fn account_state(&self) -> ProviderAccountResult {
@@ -112,24 +136,16 @@ impl ModelProvider for AmazonBedrockModelProvider {
         })
     }
 
-    async fn api_provider(&self) -> Result<Provider> {
-        let managed_auth = self.managed_auth();
-        let mut api_provider_info = self.info.clone();
-        api_provider_info.base_url =
-            Some(runtime_base_url(managed_auth.as_ref(), &self.aws).await?);
-        api_provider_info.to_api_provider(/*auth_mode*/ None)
+    fn api_provider(&self) -> ModelProviderFuture<'_, Result<Provider>> {
+        Box::pin(AmazonBedrockModelProvider::api_provider(self))
     }
 
-    async fn runtime_base_url(&self) -> Result<Option<String>> {
-        let managed_auth = self.managed_auth();
-        Ok(Some(
-            runtime_base_url(managed_auth.as_ref(), &self.aws).await?,
-        ))
+    fn runtime_base_url(&self) -> ModelProviderFuture<'_, Result<Option<String>>> {
+        Box::pin(AmazonBedrockModelProvider::runtime_base_url(self))
     }
 
-    async fn api_auth(&self) -> Result<SharedAuthProvider> {
-        let managed_auth = self.managed_auth();
-        resolve_provider_auth(managed_auth.as_ref(), &self.aws).await
+    fn api_auth(&self) -> ModelProviderFuture<'_, Result<SharedAuthProvider>> {
+        Box::pin(AmazonBedrockModelProvider::api_auth(self))
     }
 
     fn models_manager(