fix: fully revert agent identity runtime wiring (#18757)

## Summary

This PR fully reverts the previously merged Agent Identity runtime
integration from the old stack:
https://github.com/openai/codex/pull/17387/changes

It removes the Codex-side task lifecycle wiring, rollout/session
persistence, feature flag plumbing, lazy `auth.json` mutation,
background task auth paths, and request callsite changes introduced by
that stack.

This leaves the repo in a clean pre-AgentIdentity integration state so
the follow-up PRs can reintroduce the pieces in smaller reviewable
layers.

## Stack

1. This PR: full revert
2. https://github.com/openai/codex/pull/18871: move Agent Identity
business logic into a crate
3. https://github.com/openai/codex/pull/18785: add explicit
AgentIdentity auth mode and startup task allocation
4. https://github.com/openai/codex/pull/18811: migrate auth callsites
through AuthProvider

## Testing

Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

codex-rs/core/src/connectors.rs

@@ -43,7 +43,7 @@ use codex_mcp::ToolInfo;
 use codex_mcp::ToolPluginProvenance;
 use codex_mcp::codex_apps_tools_cache_key;
 use codex_mcp::compute_auth_statuses;
-use codex_mcp::with_codex_apps_mcp_with_authorization_header;
+use codex_mcp::with_codex_apps_mcp;
 
 const CONNECTORS_READY_TIMEOUT_ON_EMPTY_TOOLS: Duration = Duration::from_secs(30);
 const DIRECTORY_CONNECTORS_TIMEOUT: Duration = Duration::from_secs(60);
@@ -220,20 +220,8 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
         });
     }
 
-    let background_authorization_header_value = if let Some(auth) = auth.as_ref() {
-        auth_manager
-            .chatgpt_authorization_header_for_auth(auth)
-            .await
-    } else {
-        None
-    };
     let mcp_config = config.to_mcp_config(plugins_manager.as_ref()).await;
-    let mcp_servers = with_codex_apps_mcp_with_authorization_header(
-        HashMap::new(),
-        auth.as_ref(),
-        &mcp_config,
-        background_authorization_header_value.as_deref(),
-    );
+    let mcp_servers = with_codex_apps_mcp(HashMap::new(), auth.as_ref(), &mcp_config);
     if mcp_servers.is_empty() {
         return Ok(AccessibleConnectorsStatus {
             connectors: Vec::new(),
@@ -435,18 +423,6 @@ async fn list_directory_connectors_for_tool_suggest_with_auth(
     };
     let access_token = token_data.access_token.clone();
     let account_id = account_id.to_string();
-    let is_fedramp_account = token_data.id_token.is_fedramp_account();
-    let authorization_header_value = {
-        let auth_manager =
-            AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ false);
-        match auth {
-            Some(auth) if auth.is_chatgpt_auth() => auth_manager
-                .chatgpt_authorization_header_for_auth(auth)
-                .await
-                .unwrap_or_else(|| format!("Bearer {access_token}")),
-            _ => format!("Bearer {access_token}"),
-        }
-    };
     let is_workspace_account = token_data.id_token.is_workspace_account();
     let cache_key = AllConnectorsCacheKey::new(
         config.chatgpt_base_url.clone(),
@@ -460,15 +436,14 @@ async fn list_directory_connectors_for_tool_suggest_with_auth(
         is_workspace_account,
         /*force_refetch*/ false,
         |path| {
-            let authorization_header_value = authorization_header_value.clone();
+            let access_token = access_token.clone();
             let account_id = account_id.clone();
             async move {
-                chatgpt_get_request_with_authorization_header::<DirectoryListResponse>(
+                chatgpt_get_request_with_token::<DirectoryListResponse>(
                     config,
                     path,
-                    authorization_header_value.as_str(),
+                    access_token.as_str(),
                     account_id.as_str(),
-                    is_fedramp_account,
                 )
                 .await
             }
@@ -477,25 +452,23 @@ async fn list_directory_connectors_for_tool_suggest_with_auth(
     .await
 }
 
-async fn chatgpt_get_request_with_authorization_header<T: DeserializeOwned>(
+async fn chatgpt_get_request_with_token<T: DeserializeOwned>(
     config: &Config,
     path: String,
-    authorization_header_value: &str,
+    access_token: &str,
     account_id: &str,
-    is_fedramp_account: bool,
 ) -> anyhow::Result<T> {
     let client = create_client();
     let url = format!("{}{}", config.chatgpt_base_url, path);
-    let mut request = client
+    let response = client
         .get(&url)
-        .header("authorization", authorization_header_value)
+        .bearer_auth(access_token)
         .header("chatgpt-account-id", account_id)
         .header("Content-Type", "application/json")
-        .timeout(DIRECTORY_CONNECTORS_TIMEOUT);
-    if is_fedramp_account {
-        request = request.header("X-OpenAI-Fedramp", "true");
-    }
-    let response = request.send().await.context("failed to send request")?;
+        .timeout(DIRECTORY_CONNECTORS_TIMEOUT)
+        .send()
+        .await
+        .context("failed to send request")?;
 
     if response.status().is_success() {
         response