fix(codex): recover from stale official OAuth session context

[msgaxzzz]

Summary

• detect Codex official API failures explicitly
• show a clearer user-facing error for stale official session/OAuth context
• reset the persisted Codex runtime thread binding after this failure so the next retry creates a fresh official session
• add regression coverage for the stale encrypted-context recovery path

Root Cause

When Codex was using the official logged-in flow, a resumed session could fail if the stored encrypted context no longer matched the current provider, account, or login state. cc-web surfaced the failure, but it kept the stale runtime thread binding, so subsequent retries continued to hit the same broken context.

Fix

• map to a dedicated Codex runtime error message
• clear the persisted runtime session binding when that error occurs
• keep the session usable so the user can resend once and establish a fresh official session

Test

• added mock Codex failure coverage for
• added regression test asserting the stale thread binding is cleared after the failure