[codex] Pin Python SDK to glibc-compatible runtime (#25907)

## Summary
- pin the Python SDK runtime package to `openai-codex-cli-bin==0.136.0`
so Ubuntu/glibc installs resolve a compatible wheel
- refresh generated SDK artifacts and lock data for the runtime update
- keep newly generated client-message-id wire models internal to the
generated protocol layer

## Dependency
- merge #25906 first so the Python SDK release publishes both manylinux
and musllinux runtime wheels before publishing the package with this pin

## Validation
- ran `just fmt`
- regenerated the Python public API helpers
- validated the edited workflow YAML
- CI passed 29/29 checks

sdk/python/tests/test_artifact_workflow_and_binaries.py

@@ -265,8 +265,9 @@ def test_schema_normalization_only_flattens_string_literal_oneofs(
         "AuthMode",
         "InputModality",
         "ExperimentalFeatureStage",
-        "ProcessOutputStream",
+        "AutoCompactTokenLimitScope",
         "CommandExecOutputStream",
+        "ProcessOutputStream",
     ]
 
 
@@ -357,10 +358,10 @@ def test_source_sdk_template_pins_published_runtime() -> None:
         "dependencies": pyproject["project"]["dependencies"],
     } == {
         "sdk_template_version": "0.0.0-dev",
-        "runtime_pin": "0.132.0",
+        "runtime_pin": "0.136.0",
         "dependencies": [
             "pydantic>=2.12",
-            "openai-codex-cli-bin==0.132.0",
+            "openai-codex-cli-bin==0.136.0",
         ],
     }
 
@@ -435,7 +436,7 @@ def test_runtime_setup_reads_independent_runtime_pin_and_release_tags() -> None:
     } == {
         "package_name": "openai-codex-cli-bin",
         "sdk_template_version": "0.0.0-dev",
-        "runtime_pin": "0.132.0",
+        "runtime_pin": "0.136.0",
         "normalized_release_version": "0.116.0a1",
         "release_tag": "rust-v0.116.0-alpha.1",
     }
@@ -594,11 +595,11 @@ def test_stage_runtime_release_can_pin_wheel_platform_tag(tmp_path: Path) -> Non
         tmp_path / "runtime-stage",
         "0.116.0a1",
         package_archive,
-        platform_tag="musllinux_1_1_x86_64",
+        platform_tag="manylinux_2_17_x86_64",
     )
 
     pyproject = (staged / "pyproject.toml").read_text()
-    assert 'platform-tag = "musllinux_1_1_x86_64"' in pyproject
+    assert 'platform-tag = "manylinux_2_17_x86_64"' in pyproject
 
 
 def test_stage_runtime_release_rejects_incomplete_package_layout(tmp_path: Path) -> None:
@@ -650,7 +651,7 @@ def test_stage_sdk_release_preserves_reviewed_runtime_pin(tmp_path: Path) -> Non
         "version": "0.1.0b1",
         "dependencies": [
             "pydantic>=2.12",
-            "openai-codex-cli-bin==0.132.0",
+            "openai-codex-cli-bin==0.136.0",
         ],
     }
     assert (
@@ -687,7 +688,7 @@ def test_sdk_beta_release_can_pin_stable_runtime(tmp_path: Path) -> None:
     )
     runtime_stage = script.stage_python_runtime_package(
         tmp_path / "runtime-stage",
-        "0.132.0",
+        "0.136.0",
         package_archive,
     )
 
@@ -700,10 +701,10 @@ def test_sdk_beta_release_can_pin_stable_runtime(tmp_path: Path) -> None:
         "sdk_dependencies": sdk_pyproject["project"]["dependencies"],
     } == {
         "sdk_version": "0.1.0b1",
-        "runtime_version": "0.132.0",
+        "runtime_version": "0.136.0",
         "sdk_dependencies": [
             "pydantic>=2.12",
-            "openai-codex-cli-bin==0.132.0",
+            "openai-codex-cli-bin==0.136.0",
         ],
     }
 
@@ -762,7 +763,7 @@ def test_stage_runtime_stages_package_without_type_generation(tmp_path: Path) ->
             "--codex-version",
             "rust-v0.116.0-alpha.1",
             "--platform-tag",
-            "musllinux_1_1_x86_64",
+            "manylinux_2_17_x86_64",
         ]
     )
 
@@ -793,7 +794,7 @@ def test_stage_runtime_stages_package_without_type_generation(tmp_path: Path) ->
 
     script.run_command(args, ops)
 
-    assert calls == ["stage_runtime:0.116.0a1:musllinux_1_1_x86_64:codex-package.tar.gz"]
+    assert calls == ["stage_runtime:0.116.0a1:manylinux_2_17_x86_64:codex-package.tar.gz"]
 
 
 def test_default_runtime_is_resolved_from_installed_runtime_package(

sdk/python/tests/test_contract_generation.py

@@ -40,7 +40,7 @@ def test_generated_files_are_up_to_date():
 
     # Regenerate contract artifacts via the pinned runtime package, not a local
     # app-server binary from the checkout or CI environment.
-    assert importlib.metadata.version("openai-codex-cli-bin") == "0.132.0"
+    assert importlib.metadata.version("openai-codex-cli-bin") == "0.136.0"
     env = os.environ.copy()
     env.pop("CODEX_EXEC_PATH", None)
     python_bin = str(Path(sys.executable).parent)