feat: add external task refs and opt-in flag

[adrian-openai]

Stack

This is PR 1 of the HAI external-task-ref stack:

• #19047 Task registration primitives: add typed task/runtime ids, task kinds, optional external_task_ref, and the use_agent_identity experimental flag.
• #19049 ChatGPT runtime opt-in: let flagged ChatGPT auth provision/reuse Agent Identity runtime auth while JWT mode stays unchanged.
• #19051 Provider-scoped thread auth: resolve first-party inference auth with ThreadId as external_task_ref and use task AgentAssertions.
• #19054 Background auth bridge: keep sessionless control-plane Agent Identity auth hidden behind a process-local background task helper.

Summary

The new backend contract makes task_id backend-owned and opaque. Codex should send a stable logical reference for thread-scoped work and let HAI resolve or create the task. This PR adds the small crate-level primitives needed for that shape before core/model-provider code starts using them.

What changed:

• adds AgentTaskExternalRef for the optional task registration external_task_ref field
• keeps external_task_ref omitted by default so old registration requests remain valid
• keeps RegisteredAgentTask / AgentTaskKind as typed helpers around backend-owned task ids
• preserves the existing AgentAssertion wire shape: agent_runtime_id, task_id, timestamp, and signature
• keeps the disabled-by-default use_agent_identity experimental flag available for the later ChatGPT opt-in path

Testing

• cargo test -p codex-agent-identity

[nicksteele-oai]

This looks fine to me