Load agent identity from CODEX_AGENT_IDENTITY

[efrazer-oai]

Stack

1. Accept JWT agent identity auth input #18176 - Accept JWT agent identity auth input
2. Enable agent identity for tokenless startup auth #18177 - Enable agent identity for tokenless startup auth
3. Load agent identity from CODEX_AGENT_IDENTITY #18180 - Load agent identity from CODEX_AGENT_IDENTITY

What changed

Auth loading can now read CODEX_AGENT_IDENTITY when env auth is enabled.

The env var contains the same agent identity JWT accepted by auth.json in #18176. CodexAuth::from_agent_identity_jwt(...) turns that JWT into ephemeral tokenless ChatGPT auth with one stored agent identity record.

CODEX_API_KEY still wins if both env vars are set.

Validation

• cd codex-rs && just fmt
• cd codex-rs && cargo check -p codex-login -p codex-core
• cd codex-rs && cargo test -p codex-login agent_identity
• cd codex-rs && cargo test -p codex-login load_auth_reads_agent_identity_from_env
• cd codex-rs && cargo test -p codex-login enforce_login_restrictions
• cd codex-rs && just fix -p codex-login