Remove codex-core's direct reqwest dependency (#36076)

## Why

`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.

## What changed

- Use `http` header and status types directly in core code and tests.
- Build the MCP test readiness client through `HttpClientBuilder`.
- Remove `reqwest` from `codex-core` and its temporary dependency-policy
  exception.

GitOrigin-RevId: 8d5c7c86256294a7bb8aa1ae10cc5bea4cb1fc56

codex-rs/Cargo.lock

@@ -2774,7 +2774,6 @@ dependencies = [
  "pretty_assertions",
  "rand 0.9.3",
  "regex-lite",
- "reqwest 0.12.28",
  "rmcp",
  "serde",
  "serde_json",

codex-rs/core/Cargo.toml

@@ -92,7 +92,6 @@ libc = { workspace = true }
 once_cell = { workspace = true }
 rand = { workspace = true }
 regex-lite = { workspace = true }
-reqwest = { workspace = true, features = ["json", "stream"] }
 rmcp = { workspace = true, default-features = false, features = [
     "base64",
     "macros",

codex-rs/core/src/client.rs

@@ -95,8 +95,7 @@ use eventsource_stream::EventStreamError;
 use futures::StreamExt;
 use http::HeaderMap as ApiHeaderMap;
 use http::HeaderValue;
-use http::StatusCode as HttpStatusCode;
-use reqwest::StatusCode;
+use http::StatusCode;
 use std::time::Duration;
 use std::time::Instant;
 use tokio::sync::mpsc;
@@ -2323,7 +2322,7 @@ impl RequestTelemetry for ApiTelemetry {
     fn on_request(
         &self,
         attempt: u64,
-        status: Option<HttpStatusCode>,
+        status: Option<StatusCode>,
         error: Option<&TransportError>,
         duration: Duration,
     ) {

codex-rs/core/tests/suite/external_auth.rs

@@ -7,9 +7,9 @@ use core_test_support::responses::sse;
 use core_test_support::responses::start_mock_server;
 use core_test_support::skip_if_no_network;
 use core_test_support::test_codex::test_codex;
-use reqwest::header::AUTHORIZATION;
-use reqwest::header::HeaderMap;
-use reqwest::header::HeaderValue;
+use http::HeaderMap;
+use http::HeaderValue;
+use http::header::AUTHORIZATION;
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn header_auth_is_attached_to_responses_requests() -> anyhow::Result<()> {

codex-rs/core/tests/suite/rmcp_client.rs

@@ -27,6 +27,7 @@ use codex_exec_server::Environment;
 use codex_exec_server::HttpRedirectPolicy;
 use codex_exec_server::HttpRequestParams;
 use codex_features::Feature;
+use codex_http_client::HttpClientBuilder;
 use codex_login::CodexAuth;
 use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_mcp::MCP_SANDBOX_STATE_META_CAPABILITY;
@@ -72,12 +73,11 @@ use core_test_support::test_codex::turn_permission_fields;
 use core_test_support::test_docker_container_name;
 use core_test_support::wait_for_event;
 use core_test_support::wait_for_mcp_server;
+use http::StatusCode;
 use image::DynamicImage;
 use image::GenericImageView;
 use image::ImageBuffer;
 use image::Rgba;
-use reqwest::Client;
-use reqwest::StatusCode;
 use serde_json::Value;
 use serde_json::json;
 use serial_test::serial;
@@ -3480,7 +3480,7 @@ async fn wait_for_local_streamable_http_server(
 ) -> anyhow::Result<()> {
     let deadline = Instant::now() + timeout;
     let metadata_url = streamable_http_metadata_url(server_url);
-    let client = Client::builder().no_proxy().build()?;
+    let client = HttpClientBuilder::new().build_direct()?;
     loop {
         if let Some(status) = server_child.try_wait()? {
             return Err(anyhow::anyhow!(
@@ -3584,7 +3584,7 @@ async fn wait_for_streamable_http_metadata(
 ) -> anyhow::Result<()> {
     let deadline = Instant::now() + timeout;
     let metadata_url = streamable_http_metadata_url(server_url);
-    let client = Client::builder().no_proxy().build()?;
+    let client = HttpClientBuilder::new().build_direct()?;
     loop {
         let remaining = deadline.saturating_duration_since(Instant::now());
         if remaining.is_zero() {

codex-rs/deny.toml

@@ -243,7 +243,6 @@ deny = [
         "codex-responses-api-proxy",
         # Temporary migration exceptions.
         "codex-app-server",
-        "codex-core",
         "codex-ollama",
         "codex-otel",
         # Third-party crates that own their reqwest integration. These are not part of the