Fix Codex env-key authentication readiness

[salman1993]

Why

Codex supports custom providers authenticated through [model_providers.<id>] env_key, but Buzz relied only on codex login status. That false negative showed “Sign-in needed” and sent otherwise valid agents into setup mode.

What

• Resolve the active Codex provider’s configured env_key and validate that its effective or process environment value is non-empty
• Treat that credential path as logged in during runtime discovery and as ready during backend spawn checks
• Preserve adapter and CLI availability checks, falling back to the existing login probe when env-key authentication is absent
• Cover active, inactive, malformed, empty, ready, and missing-tooling cases

Risk Assessment

Low — the change is limited to Codex providers that explicitly declare an env_key. Missing, malformed, or empty values retain the existing fail-closed login behavior.

Validation

• bin/just desktop-check at 7fbe0b1447d3c94b242c03d89ca9a15613a6336e
• bin/just desktop-tauri-test at 7fbe0b1447d3c94b242c03d89ca9a15613a6336e

References

• Closes Codex harness reports "Sign-in needed" when authenticated via a provider env_key #4755

Generated with Codex

[Chessing234]

runtime_auth::initial_status calls codex_env_key_auth_satisfied(&Default::default()) — an empty BTreeMap. so at the discovery call site the effective_env arm of env_key_value_is_set can never match and only the std::env::var_os fallback can satisfy it. a key that lives in the managed agent's own env_vars (rather than the desktop process environment) still reads as logged out, which is the case the parameter appears to exist for.

also worth knowing: claude has the same split you are fixing here — the probe runs claude auth status while the spawned claude-agent-acp also honours CLAUDE_CODE_OAUTH_TOKEN (#5460). #5822 handles it by declaring token env vars on KnownAcpRuntime and settling them before the probe phase, which is the same seam initial_status/needs_probe restructure. these two will collide in discover_acp_runtimes_from; one declarative field would cover both runtimes instead of an id-keyed special case per runtime.