[codex] allow CCA image generation and web search extensions (#29909)

## Summary

- allow the standalone image-generation and web-search extensions for
the actor-authorized provider shape used by CCA
- preserve builtin `image_generation` and `web_search` for older models
and existing flows
- keep ordinary non-OpenAI providers excluded from both extensions
- remove only the image extension local managed-AuthManager requirement
that CCA cannot satisfy
- share actor-authorization detection through `ModelProviderInfo`
- keep Core tests focused on routing behavior and cover header-shape
edge cases in `model-provider-info`
- add a Responses Lite regression that verifies both
`image_gen.imagegen` and `web.run`

## Why

CCA uses a provider named `local` with `requires_openai_auth: false` and
a non-empty `x-openai-actor-authorization` header. Core accepts that
provider shape, but both extension provider-name gates rejected it;
image generation additionally required a Codex-managed login.

The standalone paths must coexist with existing builtin tools. New
Responses Lite models can receive `image_gen.imagegen` and `web.run`,
while older models continue using builtin tools.

## Impact

This enables both standalone extensions for CCA once installed
downstream, without removing or changing builtin-tool compatibility for
older models.

## Validation

- `just test -p codex-core
responses_lite_exposes_standalone_tools_for_actor_authorized_provider`
- `just test -p codex-core
responses_lite_uses_standalone_web_search_and_image_generation`
- `just test -p codex-core
hosted_tools_follow_provider_auth_model_and_config_gates`
- `just test -p codex-image-generation-extension`
- `just test -p codex-web-search-extension`
- `just test -p codex-model-provider-info`
- `just fmt`
- `git diff --check`

codex-rs/ext/image-generation/src/extension.rs

@@ -34,11 +34,11 @@ struct ImageGenerationExtensionConfig {
 }
 
 impl ImageGenerationExtensionConfig {
-    /// Resolves whether standalone image generation should be available for a thread.
+    /// Resolves the image provider and save root for a thread.
     fn from_config(config: &Config, resolve_save_root: &SaveRootResolver) -> Self {
         Self {
-            // Core selects this executor per turn using the feature flag or model metadata.
-            available: config.model_provider.is_openai(),
+            available: config.model_provider.is_openai()
+                || config.model_provider.uses_openai_actor_authorization(),
             provider: config.model_provider.clone(),
             save_root: resolve_save_root(config),
         }
@@ -46,7 +46,7 @@ impl ImageGenerationExtensionConfig {
 }
 
 impl ThreadLifecycleContributor<Config> for ImageGenerationExtension {
-    /// Seeds image-generation availability when a thread begins.
+    /// Seeds image-generation configuration when a thread begins.
     fn on_thread_start<'a>(
         &'a self,
         input: ThreadStartInput<'a, Config>,
@@ -63,7 +63,7 @@ impl ThreadLifecycleContributor<Config> for ImageGenerationExtension {
 }
 
 impl ConfigContributor<Config> for ImageGenerationExtension {
-    /// Refreshes image-generation availability after thread configuration changes.
+    /// Refreshes image-generation configuration after thread configuration changes.
     fn on_config_changed(
         &self,
         _session_store: &ExtensionData,
@@ -88,7 +88,7 @@ impl ToolContributor for ImageGenerationExtension {
         let Some(config) = thread_store.get::<ImageGenerationExtensionConfig>() else {
             return Vec::new();
         };
-        if !config.available || !self.auth_manager.current_auth_uses_codex_backend() {
+        if !config.available {
             return Vec::new();
         }
 

codex-rs/ext/web-search/src/extension.rs

@@ -41,7 +41,8 @@ impl From<&Config> for WebSearchExtensionConfig {
         let web_search_mode = config.web_search_mode.value();
         Self {
             // Core selects this executor per turn using the feature flag or model metadata.
-            available: config.model_provider.is_openai()
+            available: (config.model_provider.is_openai()
+                || config.model_provider.uses_openai_actor_authorization())
                 && web_search_mode != WebSearchMode::Disabled,
             provider: config.model_provider.clone(),
             settings: search_settings(config, web_search_mode),