Refresh signed exec-server URLs on reconnect

[apanasenko-oai]

Summary

• add a provider API that supplies a fresh signed WebSocket URL for each remote exec-server connection
• refresh the signed URL after disconnects and retry once when a handshake returns 401 Unauthorized
• allow EnvironmentManager consumers to register remote environments backed by the URL provider

Tests

• just test -p codex-exec-server -E 'test(remote_websocket_client_refreshes_url_after_unauthorized_handshake) | test(remote_websocket_client_refreshes_url_after_disconnect)' — 2 passed
• cargo check -p codex-core-api — passed
• just fix -p codex-exec-server — passed
• just fix -p codex-core-api — no test targets; no-op
• just fmt — passed
• just test -p codex-exec-server — 187 passed; 32 unrelated macOS sandbox tests could not invoke nested sandbox-exec (Operation not permitted)