Add Codex app-server auth and optional assignments

[kcosr]

Summary

• add Codex app-server auth token support for websocket and UDS transports via backendConfig.codex.authTokenEnv and AGENT_RUNNER_CODEX_AUTH_TOKEN_ENV
• resolve token values at connection time instead of persisting literal secrets in run state
• allow agent-only run input surfaces and new-run flows by making assignment selection optional where supported
• address review feedback by allowing bearer auth policy for IPv6 loopback plaintext websocket URLs and tightening affected tests

Validation

• npm install
• env -u AGENT_RUNNER_TEST_REMOTE_HOST -u AGENT_RUNNER_CODEX_UDS_PATH -u AGENT_RUNNER_CODEX_WS_URL -u AGENT_RUNNER_CODEX_AUTH_TOKEN_ENV npm run check

Note: the env cleanup avoids local machine transport/remote-test settings leaking into the standard check; CI should run with a clean environment.