fix: recover Codex OAuth refresh after shared auth rotation

[dwayn]

Summary

This hardens Codex OAuth refresh handling for long-lived Hindsight processes that share Codex CLI auth state with other processes.

When a refresh request fails because the refresh token was already rotated elsewhere, Hindsight now re-reads auth.json under the shared lock and recovers when possible:

• If the disk access token is fresh, Hindsight adopts it and avoids an unnecessary second refresh.
• If the disk access token is stale but the disk refresh token changed, Hindsight retries refresh once with the newer disk refresh token.
• If disk credentials did not change or still cannot recover, Hindsight continues to surface the existing terminal auth error.

This also adds regression coverage for the refresh-token reuse race and ensures Codex OAuth embedding tests are isolated from developer or CI CODEX_HOME environment settings.

Test Plan

• uv run pytest -n0 tests/test_codex_oauth_refresh.py tests/test_codex_home_env.py tests/test_codex_request_headers.py tests/test_embeddings_openai_batch_size.py -q
• uv run ruff check hindsight_api/engine/providers/codex_auth.py tests/test_codex_oauth_refresh.py
• uv run ruff format --check hindsight_api/engine/providers/codex_auth.py tests/test_codex_oauth_refresh.py
• uv run ty check hindsight_api/engine/providers/codex_auth.py
• git diff --check

[strix-security]

Strix Security Review

No security issues found.

_{Updated for e3320e4.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}

[dwayn]

I ran into this race condition in hindsight where it got hung up and failed to auth due to consumed refresh token, so I tasked my agent with tracking down and fixing the cause. It found this race condition problem and patched it, so I thought I would share it.

It happened to find a couple of little regression issues in a couple of places where CODEX_HOME was not being cleared during tests and was causing it to misbehave because my agent has an explicit CODEX_HOME set in its environment.

My Hermes agent is sharing codex auth with hindsight by bind mounting .codex directory into hindsight container so that I don’t have to install and auth codex separately in the hindsight container. I think this is also why I had the fun of running into this race condition in the first place, but it had been working great for a while until I hit this snag, so this is not a particularly high probability race but can/does occur.