Route Guardian inference through dedicated endpoints (#40892)

## What changed

- Add the opt-in `features.guardianv2.free_guardian` setting to route eligible
  Guardian reviews to `/guardian` and asynchronous classifications to
  `/guardian-classifier`.
- Support endpoint selection for both HTTP and WebSocket Responses clients,
  including endpoint-aware connection reuse.
- Keep `/responses` for API-key authentication, custom provider URLs,
  non-Guardian models, and configurations where the option is disabled.
- Omit routing hints and `service_tier` from requests sent to the dedicated
  Guardian endpoints.

## Testing

- Cover route selection across authentication modes, provider URLs, HTTP
  fallback, WebSocket review sessions, and classifier sampling.

GitOrigin-RevId: 9c88673c710d009e0239559b9245a4e6c4f4befc

codex-rs/model-provider-info/src/lib.rs

@@ -468,6 +468,15 @@ impl ModelProviderInfo {
         self.name == OPENAI_PROVIDER_NAME
     }
 
+    pub fn supports_codex_backend_routes(&self) -> bool {
+        self.is_openai()
+            && self.base_url.as_deref().is_none_or(|base_url| {
+                base_url
+                    .trim_end_matches('/')
+                    .ends_with("/backend-api/codex")
+            })
+    }
+
     pub fn uses_openai_actor_authorization(&self) -> bool {
         !self.requires_openai_auth
             && self.http_headers.as_ref().is_some_and(|headers| {

codex-rs/model-provider-info/src/model_provider_info_tests.rs

@@ -154,6 +154,19 @@ fn test_header_auth_uses_chatgpt_codex_base_url() {
     assert_eq!(api_provider.base_url, CHATGPT_CODEX_BASE_URL);
 }
 
+#[test]
+fn codex_backend_routes_require_codex_base_url() {
+    for (base_url, expected) in [
+        (None, true),
+        (Some(CHATGPT_CODEX_BASE_URL), true),
+        (Some("https://chatgpt-staging.com/backend-api/codex/"), true),
+        (Some("https://proxy.example.com/v1"), false),
+    ] {
+        let provider = ModelProviderInfo::create_openai_provider(base_url.map(str::to_owned));
+        assert_eq!(provider.supports_codex_backend_routes(), expected);
+    }
+}
+
 #[test]
 fn test_uses_openai_actor_authorization() {
     let mut provider = ModelProviderInfo {