Forward Codex compute residency headers

[alphastorm]

Fixes #287.

Problem

fx sends ChatGPT subscription credentials directly to the Codex model and response endpoints, but drops the namespaced chatgpt_compute_residency claim. Region-constrained Enterprise and Edu workspaces can be rejected despite valid OAuth credentials.

Change

• decode bounded compute residency alongside the existing ChatGPT account ID
• omit missing, no_constraint, malformed, control-bearing, and oversized values
• forward x-openai-internal-codex-residency on both /models and /responses requests
• keep ChatGPT credentials and residency metadata off Vercel AI Gateway traffic
• cover claim semantics, model discovery, response/tool loops, refresh-safe ownership, and origin isolation

chatgpt_data_residency is intentionally ignored because it describes storage at rest; inference routing follows chatgpt_compute_residency, matching anomalyco/opencode#42432.

Verification

Exact head: 9445516e1ca6fa9e170fe7e41f435650fed9763e
Parent: v0.0.6 (79666393e5f613c85f2f0b4b65475f1addd55379)

• changed-file zig fmt --check: passed
• scripts/check-public-surface.sh: passed
• bounded request-identity focused Zig tests: 14 passed
• focused ACP model-discovery E2E: 1 passed; direct model request carried residency and Gateway traffic did not
• focused response/tool-loop E2E: 1 passed; both direct response requests carried residency and Gateway received no request
• native build: passed
• built ./zig-out/bin/fx loopback smoke: model discovery and ask exited 0 with empty stderr; direct model and response requests carried account and residency; forced auth refresh retained the header only on direct Codex requests
• current origin/main merge simulation: clean

Full CI passed all four platform aggregates on the exact head: https://github.com/alphastorm/fx/actions/runs/32898386209

Final ship gate: SHIP for 9445516e1ca6fa9e170fe7e41f435650fed9763e.