Fix Codex native auth routing

[doedja]

What changed

• Select the native Codex upstream from the active login method.
• Use the ChatGPT Codex backend for ChatGPT login and the Platform API for API-key login.
• Run Codex through an HTTP-only process-scoped provider so unsupported WebSocket attempts do not delay startup.
• Release the fix as @kenarihq/cli@0.3.1.

Root cause

Kenari set openai_base_url to its local router while hardcoding the native upstream to api.openai.com/v1. Codex kept using the ChatGPT access token, so native requests reached the Platform API with the wrong credential scope. The built-in provider also attempted WebSocket transport even though model-aware routing requires the request body.

Impact

Native Codex models work with both ChatGPT and API-key login. ChatGPT sessions no longer fail with missing api.responses.read or api.responses.write scopes, and startup no longer waits through WebSocket retries.

Checks

• npm test, 85 passing
• Native ChatGPT cold test through the local wrapper
• No WebSocket fallback or HTTP 401 in the cold test
• npm pack --dry-run --json
• git diff --check