fix(codex): recover invalid encrypted history

[ryanngit]

Summary

• Retry same Codex account once when upstream rejects stale reasoning.encrypted_content.
• Clone request, remove ciphertext only from reasoning input items, and drop items left without summary/content.
• Preserve valid encrypted reasoning on normal requests.
• Treat repeated invalid_encrypted_content failure as deterministic so account fallback does not rotate or cool down unrelated accounts.

Why

Cross-provider conversations can retain encrypted reasoning from an earlier model turn. Codex rejects foreign or stale ciphertext with HTTP 400. Rotating accounts cannot repair payload; one sanitized same-account retry can.

Safety

• Recovery is gated to HTTP 400 plus exact error code or verification/decryption message.
• Retry reuses model, credentials, workspace binding, proxy, and abort signal.
• Recovery runs at most once.
• Logs include removed-item count only, never ciphertext.
• Unrelated 400 responses remain unchanged.

Tests

• Focused Codex/base regression matrix: 15 passed.
• Full unit differential: 1,027 passed, same 27 baseline failures and 24 skips; stock v0.5.35 passed 1,023 with those same failures/skips.
• ESLint, syntax checks, and git diff --check passed.
• Real Codex QA verified malformed ciphertext recovers while valid ciphertext remains accepted without recovery.

[ryanngit]

v0.5.40 refresh

• Base: upstream/master = v0.5.40 (79918c7)
• Branch head: 84d8a12b5c8d73c4797aadf412f80e504ba1c1c3 (was 89c9c3819d9944668410f594271ee922de7e7957)
• Merge: merged
• Tests (TMPDIR in worktree): pass — Test Files 1 passed (1); Tests 4 passed (4);
• Files: tests/unit/codex-encrypted-content-recovery.test.js
• git diff --check: clean
• gitleaks on range: ok