401 Missing scopes: model.request

### Expected behavior

All agents should be able to use OpenAI Codex models since the OAuth flow was completed and the token is shared across all agent auth stores.




### Actual behavior


- `main` (default): ✅ Works — `errorCount: 0`, uses `openai-codex/gpt-5.3-codex` successfully
- `engineer`: ❌ Fails — `errorCount: N`, `failureCounts: { "auth": N }`
- `strategist`: ❌ Fails — `errorCount: N`, `failureCounts: { "auth": N }`

### OpenClaw version

2026.2.26 (beta channel)

### Operating system

macOS

### Install method

npm global

### Logs, screenshots, and evidence

```shell
ll three agents have **identical** OAuth tokens in their `auth-profiles.json` (same JWT, same refresh token, same accountId). Decoding the JWT payload shows:


{
  "scp": ["openid", "profile", "email", "offline_access"],
  "client_id": "app_EMoamEEZ33f0CkXaXp7hrann",
  "chatgpt_plan_type": "pro"
}


The `model.request` scope is **not** present in the JWT. However, the **default agent uses this same token successfully**, suggesting the runtime handles the token differently for the default agent.

### What We Tried (all failed)

1. **Forced token refresh** — Set `expires: 1` in engineer/strategist `auth-profiles.json` to trigger refresh. Token refreshed (new JWT, new refresh_token) but still lacks `model.request` scope. Default agent continued working.

2. **Deleted auth-profiles.json** — Removed `auth-profiles.json` from `agents/engineer/agent/` and `agents/strategist/agent/` to trigger the fallback inheritance mechanism. Files were regenerated but the 401 persists.

3. **Reset error counters** — Cleared `errorCount`, `failureCounts`, and `cooldownUntil` from usageStats. Agents retried but immediately failed again.

4. **CLI re-authentication attempts:**
   - `openclaw models auth login --agent engineer --provider openai-codex` → `Unknown provider 'openai-codex'. Loaded providers: minimax-portal`
   - `openclaw models auth setup-token --agent engineer --provider openai-codex` → `Only --provider anthropic is supported`
   - `openclaw models auth add --agent engineer` → Only shows Anthropic option
   - `openclaw onboard --agent engineer` → `unknown option '--agent'`

### Suspected Root Cause

The runtime appears to handle the default agent's OAuth token with a different code path that either:
- Adds the `model.request` scope during the API request
- Uses a different authentication mechanism (not just the bearer token)
- Has a scope bypass for the default agent

This is likely related to **Issue #13964** (isolated cron jobs use wrong agent's auth config) and **PR #13983** (fix auth config resolution for isolated agents), which does not appear to be included in version 2026.2.26.