[codex] allow image generation with provider auth

[richardopenai]

Summary

• allow the native Responses API image_generation tool when the active provider carries CCA's non-empty x-openai-actor-authorization header
• preserve the Codex-managed ChatGPT auth path, scoped to providers that actually require OpenAI auth
• keep generic custom providers excluded, including when unrelated ChatGPT credentials are cached
• retain the existing feature, provider-capability, and image-input-modality gates

Why

CCA authenticates its inference requests through the active provider's x-openai-actor-authorization and ChatGPT-Account-ID headers, so it does not have a Codex-managed login session. The previous gate therefore hid the native hosted image-generation tool despite an authenticated codex-backend path.

This change is intentionally limited to the native hosted tool. It adds no extension, MCP, plugin-service, session-source, token plumbing, or new provider configuration surface.

Tests

• cargo test -p codex-core hosted_tools_follow_provider_auth_model_and_config_gates
• cargo fmt --all -- --check
• git diff --check origin/main

[won-openai]

lgtm