[codex] Use custom provider without websockets

[Che-Zhu]

Summary

• configure Codex to use a custom provider when CODEX_OPENAI_BASE_URL is set instead of overriding the built-in openai provider
• disable websocket transport for that provider with supports_websockets = false
• keep the container runtime fixes for ca-certificates and bubblewrap, and update both READMEs to match the new provider-based behavior

Verification

• node --check src/codex-runtime.mjs
• node --check src/codex-app-server.mjs
• node --check src/bootstrap.mjs
• docker buildx build --platform linux/amd64 --load -t codex-gateway:provider-test .
• ran the image locally with the third-party upstream and verified /healthz, POST /api/sessions, and POST /api/sessions/:id/turn
• confirmed a real turn completed successfully and container logs no longer contained responses_websocket, wss://, or 503