Parent: #64227

Summary

Fix maintained-source OpenAI Codex auth scope handling and add explicit provider/runtime failure classification so GPT-5.4 failures stop collapsing into generic model-stop behavior.

Scope

• maintained-source Codex OAuth scope fix
• typed failure classification for:
  • auth_scope
  • auth_refresh
  • auth_html_403
  • proxy
  • dns
  • timeout
  • schema
  • sandbox_blocked
  • replay_invalid
  • unknown
• structured run-end telemetry separating provider failure from agent-stop behavior

Acceptance

• missing scopes classify as auth_scope
• refresh failures classify as auth_refresh
• 403 HTML classify as auth_html_403
• proxy/env misroutes classify as proxy
• DNS and timeout failures are distinct
• user-facing failure output stops masking provider/runtime causes as generic model behavior