Route Ollama through the shared HTTP client (#36078)

## Why

Ollama requests need to honor Codex's configured outbound proxy policy and custom CA handling.

## What changed

- Replace Ollama's direct `reqwest` client with a route-aware client created by `codex-http-client`.
- Preserve the five-second connection timeout and legacy system-root fallback for default-routed requests.
- Reuse one Ollama client for connectivity, version, model discovery, and model-pull checks.
- Surface HTTP transport initialization errors instead of replacing them with the generic Ollama connection error.

## Testing

- Cover system-proxy routing and invalid `CODEX_CA_CERTIFICATE` and `SSL_CERT_FILE` values under both outbound proxy policies.
- Verify that version and model checks reuse the existing Ollama client.

GitOrigin-RevId: c7cc36845a9bceb57ce5524b9e1b3cbe317897a3

codex-rs/deny.toml

@@ -243,7 +243,6 @@ deny = [
         "codex-responses-api-proxy",
         # Temporary migration exceptions.
         "codex-app-server",
-        "codex-ollama",
         "codex-otel",
         # Third-party crates that own their reqwest integration. These are not part of the
         # first-party migration count above.