feat: add run task identity primitives

[adrian-openai]

Stack

This is PR 1 of the simplified HAI single-run-task stack:

• #19047 Agent Identity assertion and task-registration primitives, including the shared run-task helper used by existing Agent Identity JWT auth.
• #19049 Disabled-by-default ChatGPT auth opt-in that provisions/reuses persisted Agent Identity runtime auth and its single run task.
• #19051 Run-scoped provider auth that uses one backend-owned task id for first-party inference and compaction requests.

#19054 collapsed out of the active stack because the simplified design no longer needs a separate background/control-plane task helper.

Summary

The simplified POC shape is one backend-owned task per Agent Identity run. This PR makes the first layer match that final shape directly instead of introducing task targets, caller-owned external task refs, or intermediate wrappers that later PRs would need to undo.

What changed:

• keeps the AgentAssertion wire payload as agent_runtime_id, task_id, timestamp, and signature
• exposes register_agent_task as the single task-registration helper for both existing Agent Identity JWT auth and the ChatGPT-registration path added later in the stack
• makes task registration send only the signed registration timestamp; the backend owns the returned opaque task id
• removes the unused target/task-kind/external-task-ref surfaces from codex-agent-identity
• keeps Agent Identity JWT JWKS lookup separate from agent/task registration URL derivation
• updates Agent Identity JWT auth to register one run task during auth construction and share that task across cloned auth handles

This PR intentionally does not enable ChatGPT-derived Agent Identity. That opt-in and config gate are added in the next PR.

Testing

• just test -p codex-agent-identity

[nicksteele-oai]

This looks fine to me

[tigrantsat-openai]

Let's ensure full set of features + launching internally before enabling into codex.