[codex] Remove async_trait from first-party code (#27475)

## Why

First-party async traits should expose their `Send` contracts explicitly
without requiring `async_trait`. This completes the migration pattern
established in #27303 and #27304.

## What changed

- Replaced the remaining first-party `async_trait` traits with native
return-position `impl Future + Send` where statically dispatched and
explicit boxed `Send` futures where object safety is required.
- Kept implementations behavior-preserving, outlining existing async
bodies into inherent methods where that keeps the diff reviewable.
- Removed all direct first-party `async-trait` dependencies and the
workspace dependency declaration.
- Added a cargo-deny policy that permits `async-trait` only through the
remaining transitive wrapper crates.
- Updated `rand` from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097 and
keep the full cargo-deny check passing.

## Validation

- `just test -p codex-exec-server`: 216 passed, 2 skipped.
- `just test -p codex-model-provider`: 39 passed.
- `just test -p codex-core` and `just test`: changed tests passed;
remaining failures are environment-sensitive suites unrelated to this
migration.
- `cargo deny check`
- `just fix`
- `just fmt`
- `cargo shear`
- `just bazel-lock-check`

codex-rs/codex-api/src/auth.rs

@@ -1,7 +1,8 @@
-use async_trait::async_trait;
 use codex_client::Request;
 use codex_client::TransportError;
 use http::HeaderMap;
+use std::future::Future;
+use std::pin::Pin;
 use std::sync::Arc;
 
 /// Error returned while applying authentication to an outbound request.
@@ -26,7 +27,6 @@ impl From<AuthError> for TransportError {
 ///
 /// Header-only providers can implement `add_auth_headers`; providers that sign
 /// complete requests can override `apply_auth`.
-#[async_trait]
 pub trait AuthProvider: Send + Sync {
     /// Adds any auth headers that are available without request body access.
     ///
@@ -52,13 +52,18 @@ pub trait AuthProvider: Send + Sync {
     ///
     /// Callers must always use the returned request as authoritative.
     /// If this returns [`AuthError`], the request should not be sent.
-    async fn apply_auth(&self, request: Request) -> Result<Request, AuthError> {
-        let mut request = request;
-        self.add_auth_headers(&mut request.headers);
-        Ok(request)
+    fn apply_auth(&self, request: Request) -> AuthProviderFuture<'_> {
+        Box::pin(async move {
+            let mut request = request;
+            self.add_auth_headers(&mut request.headers);
+            Ok(request)
+        })
     }
 }
 
+pub type AuthProviderFuture<'a> =
+    Pin<Box<dyn Future<Output = Result<Request, AuthError>> + Send + 'a>>;
+
 /// Shared auth handle passed through API clients.
 pub type SharedAuthProvider = Arc<dyn AuthProvider>;
 

codex-rs/codex-api/src/endpoint/compact.rs

@@ -77,7 +77,6 @@ struct CompactHistoryResponse {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use async_trait::async_trait;
     use codex_client::Request;
     use codex_client::Response;
     use codex_client::StreamResponse;
@@ -86,7 +85,6 @@ mod tests {
     #[derive(Clone, Default)]
     struct DummyTransport;
 
-    #[async_trait]
     impl HttpTransport for DummyTransport {
         async fn execute(&self, _req: Request) -> Result<Response, TransportError> {
             Err(TransportError::Build("execute should not run".to_string()))

codex-rs/codex-api/src/endpoint/images.rs

@@ -80,7 +80,6 @@ mod tests {
     use crate::images::ImageQuality;
     use crate::images::ImageUrl;
     use crate::provider::RetryConfig;
-    use async_trait::async_trait;
     use codex_client::Request;
     use codex_client::RequestBody;
     use codex_client::Response;
@@ -114,7 +113,6 @@ mod tests {
         }
     }
 
-    #[async_trait]
     impl HttpTransport for CapturingTransport {
         async fn execute(&self, req: Request) -> Result<Response, TransportError> {
             *self.last_request.lock().expect("lock request store") = Some(req);

codex-rs/codex-api/src/endpoint/memories.rs

@@ -71,7 +71,6 @@ mod tests {
     use crate::common::RawMemory;
     use crate::common::RawMemoryMetadata;
     use crate::provider::RetryConfig;
-    use async_trait::async_trait;
     use codex_client::Request;
     use codex_client::RequestBody;
     use codex_client::Response;
@@ -89,7 +88,6 @@ mod tests {
     #[derive(Clone, Default)]
     struct DummyTransport;
 
-    #[async_trait]
     impl HttpTransport for DummyTransport {
         async fn execute(&self, _req: Request) -> Result<Response, TransportError> {
             Err(TransportError::Build("execute should not run".to_string()))
@@ -122,7 +120,6 @@ mod tests {
         }
     }
 
-    #[async_trait]
     impl HttpTransport for CapturingTransport {
         async fn execute(&self, req: Request) -> Result<Response, TransportError> {
             *self.last_request.lock().expect("lock request store") = Some(req);

codex-rs/codex-api/src/endpoint/models.rs

@@ -78,7 +78,6 @@ mod tests {
     use super::*;
     use crate::auth::AuthProvider;
     use crate::provider::RetryConfig;
-    use async_trait::async_trait;
     use codex_client::Request;
     use codex_client::Response;
     use codex_client::StreamResponse;
@@ -108,7 +107,6 @@ mod tests {
         }
     }
 
-    #[async_trait]
     impl HttpTransport for CapturingTransport {
         async fn execute(&self, req: Request) -> Result<Response, TransportError> {
             *self.last_request.lock().unwrap() = Some(req);

codex-rs/codex-api/src/endpoint/realtime_call.rs

@@ -226,7 +226,6 @@ mod tests {
     use crate::endpoint::realtime_websocket::RealtimeOutputModality;
     use crate::endpoint::realtime_websocket::RealtimeSessionMode;
     use crate::provider::RetryConfig;
-    use async_trait::async_trait;
     use codex_client::Request;
     use codex_client::Response;
     use codex_client::StreamResponse;
@@ -265,7 +264,6 @@ mod tests {
         }
     }
 
-    #[async_trait]
     impl HttpTransport for CapturingTransport {
         async fn execute(&self, req: Request) -> Result<Response, TransportError> {
             *self.last_request.lock().unwrap() = Some(req);

codex-rs/codex-api/src/endpoint/search.rs

@@ -64,7 +64,6 @@ mod tests {
     use crate::search::SearchInput;
     use crate::search::SearchQuery;
     use crate::search::SearchSettings;
-    use async_trait::async_trait;
     use codex_client::Request;
     use codex_client::RequestBody;
     use codex_client::Response;
@@ -100,7 +99,6 @@ mod tests {
         }
     }
 
-    #[async_trait]
     impl HttpTransport for CapturingTransport {
         async fn execute(&self, req: Request) -> Result<Response, TransportError> {
             *self.last_request.lock().expect("lock request store") = Some(req);

codex-rs/codex-api/src/lib.rs

@@ -21,6 +21,7 @@ pub use crate::api_bridge::map_api_error;
 pub use crate::auth::AuthError;
 pub use crate::auth::AuthHeaderTelemetry;
 pub use crate::auth::AuthProvider;
+pub use crate::auth::AuthProviderFuture;
 pub use crate::auth::SharedAuthProvider;
 pub use crate::auth::auth_header_telemetry;
 pub use crate::common::CompactionInput;