Codex: remove OPENAI_API_KEY requirement for AWF openai-proxy provider

[Copilot]

Codex runs in AWF sandbox mode were failing with Missing environment variable: OPENAI_API_KEY even when using the AWF OpenAI proxy path. The generated config set model_provider = "openai-proxy" but still required a direct env key that is intentionally excluded from the sandbox.

• Config generation (Codex MCP)

  • Removed env_key = "OPENAI_API_KEY" from the firewall-injected [model_providers.openai-proxy] block in generated Codex TOML.
  • Kept proxy routing intact (base_url + model_provider), so Codex continues to use AWF’s proxy endpoint without requiring provider secrets in-container.

• Tests and fixtures

  • Updated Codex MCP config unit expectations to no longer require env_key for openai-proxy.
  • Updated the Codex wasm golden fixture to reflect the new generated TOML.

model_provider = "openai-proxy"

[model_providers.openai-proxy]
name = "OpenAI AWF proxy"
base_url = "http://172.30.0.30:10000"
supports_websockets = false