Vouch request: workspace-scoped OpenAI Codex credentials (openai-codex half of #2966)

[will-bogusz]

Hi @can1357 — I opened PR #6095: the openai-codex half of #2966, letting one ChatGPT email hold a personal Plus/Pro plan and Team/Enterprise seats as coexisting, load-balanced credentials (also covers the #633 scenario). The bot closed it pending a vouch per CONTRIBUTING, so — vouch request.

Note the frozen diff on the closed PR is stale; the branch has since been slimmed and hardened. Current state: live compare.

• Core is ~75 lines, riding the org-scoped identity machinery fix(ai): scope Anthropic credential identity by organization, not just email #5170 shipped for Anthropic — no codex special-case. Login captures orgId = chatgpt_account_id / orgName = chatgpt_plan_type; openai-codex folds into the org-composed identity branch (email:<e>|org:<ws>, email short-circuit removed); report↔credential matching tightened to require agreement on every identity dimension present on both sides; and a base identifier that merely repeats the workspace id is excluded from replacement claims so one member's login can never re-key a teammate's row (inert for Anthropic: account UUID ≠ org UUID).
• No codex-specific usage stamp — the provider-neutral attach path already partitions reports per workspace (pinned by a test).
• Curated regression suite pins the new invariants: coexist across workspaces, replace in place on same-workspace re-login, teammates stay distinct, legacy bare-email rows claimed one-way and never clobbered. Every existing openai-codex collapses distinct emails that share account_id in auth dedupe and /usage #197/fix auth-storage identity regression for Codex and Anthropic OAuth dedupe #343/fix(ai): restore email-first identity matching for Codex and Anthropic #344 pin passes byte-identical; bun check clean.
• Verified live end-to-end: logged into a personal Pro plan and a Team seat on one email — two coexisting rows, orgId matching each token's chatgpt_account_id, and omp usage showing both accounts with independent pools (1.76× quota headroom).

Happy to rework anything in review — could I get a vouch so I can reopen the PR?

[can1357]

!vouch will-bogusz