[codex] Use background agent task auth for backend calls

[adrian-openai]

Summary

Introduces a single user-level/background agent task for backend and control-plane requests that do not have a thread-scoped task. The background task id is stored separately from per-session task state in auth storage and reused for these calls.

This PR is stacked on PR4 and now focuses on the shared background task auth plumbing plus the first tranche of backend/control-plane consumers. The remaining callsite wiring is split into PR4.2 to keep review size down.

Stack

• PR1: Add use_agent_identity feature flag #17385 - add features.use_agent_identity
• PR2: Register agent identities behind use_agent_identity #17386 - register agent identities when enabled
• PR3: Register agent tasks behind use_agent_identity #17387 - register agent tasks when enabled
• PR3.1: Persist and prewarm agent tasks per thread #17978 - persist and prewarm registered tasks per thread
• PR4: [codex] Use AgentAssertion downstream behind use_agent_identity #17980 - use task-scoped AgentAssertion for downstream calls
• PR4.1: this PR - introduce background AgentAssertion task plumbing and initial backend/control-plane calls
• PR4.2: [codex] Use background task auth for additional backend calls #18260 - use background task auth for additional backend/control-plane calls

What Changed

• add background task registration and assertion minting in codex-login
• persist agent_identity.background_task_id separately from session task state
• expose explicit background task auth mode so config-aware callers respect features.use_agent_identity
• wire background agent assertions through app listing, connector directory listing, remote plugins, MCP status/listing, analytics, and core-skills remote calls
• preserve bearer fallback when the feature is disabled or background task registration is not available

Validation

• just fmt
• cargo check -p codex-login -p codex-analytics -p codex-mcp -p codex-core -p codex-app-server -p codex-chatgpt -p codex-cloud-tasks -p codex-cloud-requirements -p codex-models-manager
• git diff --check