feat: switch providers for loaded Codex sessions

[serjic]

Problem

Codex fixes modelProvider in the app-server thread runtime. Updating the adapter's Providers API state therefore affected newly created threads, while already loaded ACP sessions continued sending turns through the old backend.

The app-server does not currently expose an API that replaces a loaded thread's provider/config while preserving its ID.

Solution

• Serialize provider updates and wait for active prompts to complete.
• Restart the adapter-owned Codex app-server between turns.
• Reinitialize the replacement client and resume every loaded thread with its existing session ID, cwd, additional directories, and MCP servers.
• Preserve startup/native provider state and restore it on providers/disable.
• Block session operations only while the coordinated restart is in progress.
• Attempt every thread resume even if one fails, report aggregate failures, and allow a later provider update to recover.
• Add PID and provider/restart routing details to opt-in app-server logs without exposing provider headers.

Tests

Added coverage for:

• native behavior when Providers API is unused;
• gateway config passed to thread/start;
• multiple loaded sessions across native → proxy A → proxy B → native;
• all-session resume after app-server restart;
• partial resume failure and successful subsequent recovery;
• startup proxy restoration and legacy gateway auth interoperability.

Verification:

• provider suite: 14 passed
• npm run typecheck
• npm run build
• git diff --check

The repository's full suite still has the pre-existing approval/elicitation/session-close fixture mismatches; the provider suite and static/build checks are green.