feat: support Hermes-managed Codex OAuth

[Jorik-creator]

Summary

• add hermes-openai-codex as a first-class SkillClaw upstream backed by Hermes-managed ChatGPT/Codex OAuth
• resolve OAuth credentials at request time; access/refresh tokens are never stored in SkillClaw configuration
• preserve native codex_responses transport through a named loopback Hermes provider (custom:skillclaw-codex)
• force the Codex upstream hop to SSE, then correctly assemble response.completed / response.incomplete / response.failed payloads for non-streaming callers
• make streaming truncation explicit with a sanitized terminal failure event instead of silently returning a partial 200
• forward required Codex headers (originator, Codex User-Agent, ChatGPT-Account-ID)
• bound OAuth recovery, refresh each identified pool entry at most once per request, and retain 401/429 pool rotation with duplicate-token protection
• allow OAuth bearers only to the canonical HTTPS ChatGPT Codex endpoint
• require both local proxy authentication and a loopback bind at runtime
• honor $HERMES_HOME for skills, diagnostics, profile-isolated backups, and restore
• preserve user-owned provider-name collisions; fail safely rather than overwriting skillclaw-codex
• retain compatibility with generic non-OAuth providers and document the workflow in English and Chinese

Security model

Hermes remains the sole owner of ChatGPT/Codex OAuth credentials and refresh locking. SkillClaw receives only a transient access token in memory for the upstream request. OAuth access/refresh tokens are not written to ~/.skillclaw/config.yaml, Hermes config, error metadata, or logs.

The Hermes-to-SkillClaw hop uses a separate local proxy key. OAuth startup requires a loopback host. Resolver-supplied OAuth endpoints are restricted to https://chatgpt.com/backend-api/codex before an Authorization header is sent.

Merge gate / verification

Repository Actions currently run lint only, so this PR should not merge unless the following focused command passes:

uv run --extra test pytest -q tests/test_hermes_codex.py tests/test_setup_wizard.py tests/test_responses_native.py

Verified on this branch:

• focused OAuth/setup/native Responses suite: 53 passed
• suite excluding the unrelated dashboard assertion: 154 passed, 1 deselected
• full suite: 154 passed, 1 pre-existing dashboard failure
• the same dashboard failure (tests/test_dashboard.py:1504, missing evolve_status["status"]) reproduces on clean origin/main
• uvx ruff@0.12.2 check .
• uvx ruff@0.12.2 format --check .
• python -m compileall -q skillclaw tests
• live E2E, non-streaming: exact reply SKILLCLAW_HARDENED_NONSTREAM_OK
• live E2E, streaming: exact reply SKILLCLAW_HARDENED_STREAM_OK plus terminal response.completed
• live Hermes credential resolution: canonical Codex URL, transient token available, required headers present
• skillclaw doctor hermes: status ok, proxy_match: true