fix: fully revert agent identity runtime wiring (#18757)

## Summary

This PR fully reverts the previously merged Agent Identity runtime
integration from the old stack:
https://github.com/openai/codex/pull/17387/changes

It removes the Codex-side task lifecycle wiring, rollout/session
persistence, feature flag plumbing, lazy `auth.json` mutation,
background task auth paths, and request callsite changes introduced by
that stack.

This leaves the repo in a clean pre-AgentIdentity integration state so
the follow-up PRs can reintroduce the pieces in smaller reviewable
layers.

## Stack

1. This PR: full revert
2. https://github.com/openai/codex/pull/18871: move Agent Identity
business logic into a crate
3. https://github.com/openai/codex/pull/18785: add explicit
AgentIdentity auth mode and startup task allocation
4. https://github.com/openai/codex/pull/18811: migrate auth callsites
through AuthProvider

## Testing

Tests: targeted Rust checks, cargo-shear, Bazel lock check, and CI.

codex-rs/protocol/src/protocol.rs

@@ -2779,26 +2779,6 @@ impl fmt::Display for SubAgentSource {
     }
 }
 
-/// Persisted agent-task details that let a resumed thread keep using the same backend task.
-///
-/// `agent_runtime_id` is validation metadata for the globally registered agent identity, not a
-/// separate session-scoped identity. Resume only restores this task after confirming that runtime
-/// id still matches the globally registered identity; otherwise the cached task is discarded and a
-/// fresh task can be registered.
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema, TS)]
-pub struct SessionAgentTask {
-    pub agent_runtime_id: String,
-    pub task_id: String,
-    pub registered_at: String,
-}
-
-/// Session-scoped state updates that can be appended after the canonical SessionMeta line.
-#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, JsonSchema, TS, Default)]
-pub struct SessionStateUpdate {
-    #[serde(default)]
-    pub agent_task: Option<SessionAgentTask>,
-}
-
 /// SessionMeta contains session-level data that doesn't correspond to a specific turn.
 ///
 /// NOTE: There used to be an `instructions` field here, which stored user_instructions, but we
@@ -2868,7 +2848,6 @@ pub struct SessionMetaLine {
 #[serde(tag = "type", content = "payload", rename_all = "snake_case")]
 pub enum RolloutItem {
     SessionMeta(SessionMetaLine),
-    SessionState(SessionStateUpdate),
     ResponseItem(ResponseItem),
     Compacted(CompactedItem),
     TurnContext(TurnContextItem),