Separate Codex error details from retry metadata (#34996)

## What changed

- Wrap `CodexErrorDetails` and an optional retry delay in `CodexErr`, allowing any mapped error to preserve server-provided retry timing.
- Generate the payload-free `CodexErrKind` classification alongside the error details and reuse it for analytics.
- Update error handling sites to inspect `CodexErr::details()` while preserving existing display, debug, protocol mapping, and retryability behavior.

## Testing

- Add coverage for legacy debug formatting, error-specific retryability, and retry-delay propagation through API error mapping.

GitOrigin-RevId: d3ab8a305f2a2ee21d0c0a8c8c388b06dda9c59a

codex-rs/model-provider/src/auth.rs

@@ -323,6 +323,7 @@ mod tests {
     use codex_model_provider_info::WireApi;
     use codex_model_provider_info::create_oss_provider_with_base_url;
     use codex_protocol::account::PlanType;
+    use codex_protocol::error::CodexErrorDetails;
     use http::header::AUTHORIZATION;
     use pretty_assertions::assert_eq;
     use serde_json::json;
@@ -471,10 +472,12 @@ mod tests {
         });
 
         match resolve_provider_auth(Some(&auth), &provider) {
-            Err(CodexErr::UnsupportedOperation(message)) => {
-                assert_eq!(message, BEDROCK_API_KEY_UNSUPPORTED_MESSAGE);
-            }
-            Err(err) => panic!("unexpected auth error: {err:?}"),
+            Err(err) => match err.details() {
+                CodexErrorDetails::UnsupportedOperation(message) => {
+                    assert_eq!(message, BEDROCK_API_KEY_UNSUPPORTED_MESSAGE);
+                }
+                details => panic!("unexpected auth error: {details:?}"),
+            },
             Ok(_) => panic!("Bedrock API key auth should be rejected"),
         }
     }