Codex: use CODEX_API_KEY for firewall-injected openai-proxy provider config

[Copilot]

Codex smoke runs could fail when OPENAI_API_KEY was absent, even though Codex credentials were provided via CODEX_API_KEY. This updates Codex provider wiring to align generated config with Codex auth expectations and avoid missing-key failures.

• Provider credential mapping

  • Updated generated Codex model_providers.openai-proxy config to read CODEX_API_KEY instead of OPENAI_API_KEY.
  • This applies to the TOML emitted for firewall-enabled Codex runs.

• Spec/generation alignment

  • Keeps generated runtime config consistent with Codex engine auth (CODEX_API_KEY) and existing workflow secret fallback patterns.

• Expected output updates

  • Updated Codex engine unit expectations and the Codex wasm golden fixture to match the new env_key.

[model_providers.openai-proxy]
name = "OpenAI AWF proxy"
base_url = "http://172.30.0.30:10000"
env_key = "CODEX_API_KEY"
supports_websockets = false