[Auth] Add keyring support for Codex CLI

[celia-oai]

Follow-up PR to #5569. Add Keyring Support for Auth Storage in Codex CLI as well as a hybrid mode (default to persisting in keychain but fall back to file when unavailable.)

It also refactors out the keyringstore implementation from rmcp-client here to a new keyring-store crate.

There will be a follow-up that picks the right credential mode depending on the config, instead of hardcoding AuthCredentialsStoreMode::File.

[chatgpt-codex-connector]

💡 Codex Review

https://github.com/openai/codex/blob/36bc4807cb14bbfddd71f4e23077f1e999b1cd5d/codex-rs/core/src/auth.rs#L475-L477
Honor keyring storage modes when accessing CLI auth

The new AuthCredentialsStoreMode adds Keyring/Auto backends, but the top‑level helpers still instantiate storage with AuthCredentialsStoreMode::File (see logout, and similarly save_auth/load_auth_dot_json). As a result the CLI never reads or writes via the keyring and logout cannot remove keyring entries, so the feature introduced in this commit is effectively dead code. This should default to the keyring‑backed mode (or accept a user preference) so credentials are stored and deleted consistently.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[celia-oai]

💡 Codex Review

https://github.com/openai/codex/blob/36bc4807cb14bbfddd71f4e23077f1e999b1cd5d/codex-rs/core/src/auth.rs#L475-L477

Honor keyring storage modes when accessing CLI auth
The new AuthCredentialsStoreMode adds Keyring/Auto backends, but the top‑level helpers still instantiate storage with AuthCredentialsStoreMode::File (see logout, and similarly save_auth/load_auth_dot_json). As a result the CLI never reads or writes via the keyring and logout cannot remove keyring entries, so the feature introduced in this commit is effectively dead code. This should default to the keyring‑backed mode (or accept a user preference) so credentials are stored and deleted consistently.

ℹ️ About Codex in GitHub

thanks codex, this will be a followup. added to the pr description.