feat: add hidden background agent auth provider

[adrian-openai]

Stack

This is PR 4 of the HAI external-task-ref stack:

• #19047 Task registration primitives: add typed task/runtime ids, task kinds, optional external_task_ref, and the use_agent_identity experimental flag.
• #19049 ChatGPT runtime opt-in: let flagged ChatGPT auth provision/reuse Agent Identity runtime auth while JWT mode stays unchanged.
• #19051 Provider-scoped thread auth: resolve first-party inference auth with ThreadId as external_task_ref and use task AgentAssertions.
• #19054 Background auth bridge: keep sessionless control-plane Agent Identity auth hidden behind a process-task-backed provider helper.

Summary

This PR keeps the temporary background/control-plane auth bridge, but hides it inside auth-provider resolution. Sessionless control-plane callers can ask for Agent Identity auth without seeing task ids, while Codex still avoids adding any background task ids to rollout state, auth-file state, or caller-visible plumbing.

What changed:

• exposes background/control-plane auth through provider helpers rather than raw task ids
• reuses the existing process task for Agent Identity background auth instead of registering a separate Background task
• keeps background auth sessionless by not sending external_task_ref
• preserves account and FedRAMP routing headers on task-scoped AgentAssertion providers
• preserves existing bearer/API-key behavior for non-AgentIdentity auth

This intentionally does not migrate broad backend/control-plane callsites yet; that should be a separate semantic slice once this helper shape lands.

Testing

• cargo test -p codex-login
• cargo test -p codex-model-provider
• just fix -p codex-login
• just fix -p codex-model-provider

[efrazer-oai]

Any reason to add 'Background' when we already have 'Process'? They seem to do ~the same thing, might be able to cut out a few additions.

[adrian-openai]

Any reason to add 'Background' when we already have 'Process'? They seem to do ~the same thing, might be able to cut out a few additions.

Good catch @efrazer-oai - let me update this!