fix: codex data residency

[neriousy]

Issue for this PR

Closes #40243

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

ChatGPT OAuth access tokens can include a chatgpt_compute_residency requirement. OpenCode was not forwarding it to the Codex backend, so region-constrained workspaces could receive a data residency mismatch.

This change reads the current access-token claim, preferring the namespaced auth claim and falling back to the root claim. Missing, empty, and no_constraint values omit the header. Other values are forwarded without maintaining a hardcoded region list.

The x-openai-internal-codex-residency header is added only to requests rewritten to the ChatGPT Codex endpoint. It is applied before transport selection, so both HTTP and WebSocket requests receive it, including requests made after an OAuth token refresh. Data residency at rest is intentionally not used as an inference-routing requirement.

How did you verify your code works?

• bun test test/plugin/codex.test.ts test/plugin/openai-ws.test.ts — 54 passing
• bun typecheck
• Added coverage for claim extraction and precedence, no_constraint, endpoint scoping, HTTP and WebSocket propagation, and refreshed access tokens
• A live Enterprise end-to-end check was not possible because no region-constrained workspace was available

Screenshots / recordings

Not applicable.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR