2.4.41

Fixed

• Guard Copilot account connections against model-provider environment overrides,
  including when an explicit GitHub identity token is supplied.
• Require a live ChatGPT account check for Codex subscription connections before
  creating a thread and before each prompt; mask inherited API keys and restrict
  the app-server login method. Explicit runtime connections retain agent-managed
  authentication.
• Keep transport, authentication, requested billing and verification separate in
  saved routes. Migrate old ACP authentication values without implying plan
  verification, restore runtime/model choices, and stop unsupported reconnects
  instead of falling back to a previously used BYOK route.
• Describe external harness accounts as agent-managed with unverified billing.
  Reject legacy interactive plan routes in headless commands before any model call.