feat(codex): preserve prompt cache during history optimization

[alteixeira20]

Stacked on the preceding Codex native-routing draft, which is itself stacked on #223.

Please review in dependency order. This draft will be rebased/reconstructed after its dependencies merge and revalidated before being marked Ready.

Problem

Codex benefits from provider-side prompt caching, while modern Responses trajectories can contain completed function_call and custom_tool_call rounds.

Rebuilding compressed history on every newly-cold turn can mutate an already-warm prefix. Treating custom-tool items as opaque barriers can also fragment history that PXPipe can safely collapse.

A transform that saves raw tokens can therefore still be operationally worse than leaving native Codex history untouched.

Changes

• pair completed function_call and custom_tool_call rounds with their outputs by call_id;
• keep open, orphaned, malformed, and referenced protocol state native;
• split eligible cold history into deterministic sealed token-sized sections;
• leave the newest partial section native;
• require absolute, relative, and per-image materiality floors;
• observe a native request before creating the first image epoch;
• use provider-reported usage for cache feedback;
• scope cache observations to an opaque SHA-256 fingerprint of Codex thread-id;
• never retain the raw thread identifier;
• conservatively disable adaptive cache admission when no stable thread key exists;
• preserve a warm native prefix;
• permit cold/low-cache transitions only after materiality passes;
• allow warm compressed prefixes to grow only through exact append-only extensions;
• use per-segment Sol fact sheets so new sections cannot mutate older synthetic segments;
• retain only bounded token counts and short segment hashes in the cache observer;
• apply the policy only to the dedicated Codex provider route;
• leave generic OpenAI-compatible routing unchanged;
• leave native /responses/compact untouched.

Scope

No Codex launcher/router changes are introduced here; those belong to the preceding draft.

No dashboard redesign, subscription-pricing claim, model promotion, AGY work, or generic OpenAI policy change is included.

Validation

The isolated export is one commit on top of the clean Codex-routing slice.

Fresh exact-head CI passed:

• production dependency audit;
• TypeScript typecheck;
• focused cache/custom-tool/materiality regressions;
• full test suite;
• build.

The reviewable contract here is protocol/cache correctness and deterministic behavior; this PR makes no new model-readability claim.

Because this is temporarily stacked against upstream main, GitHub will initially include changes from its prerequisite PRs in the displayed diff.