[codex] route Compute Residency account override through Responses

[sgarg-oai]

Summary

• Add optional accountRoutingOverride to app-server v2 turn/start
• Carry the value only through the normal turn path and attach an encoded _account_routing_override cookie to ChatGPT-authenticated OpenAI Responses HTTP, compact, and websocket requests
• Reset cached websocket state when the override changes so a connection cannot be reused across routing values

Compute Residency

Compute Residency requires model requests to route to infrastructure that matches the selected workspace's residency. This PR is the minimal CLI/app-server transport prerequisite. The Codex Apps and ChatGPT web consumer is intentionally deferred until a released CLI exposes the generated field and a concrete app-server version gate.

Validation

• just fmt
• just test -p codex-core account_routing_override
• just test -p codex-app-server-protocol
• cargo check -p codex-app-server
• just bazel-lock-update
• just fix -p codex-core

Three independent review passes checked request routing, app-server API compatibility, and scope/regression risk. The provider-auth scoping finding was fixed before opening this draft.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}