fix: harden codex responses preflight and stream error handling

[curtitoo]

Summary

This patch fixes two Codex Responses failure modes in run_agent.py:

1. omit tools entirely when no tools are present in _preflight_codex_api_kwargs()
2. catch transport-level stream failures in _run_codex_stream() and fall back to create(stream=True) after retry

Problem

Hermes had two Codex-specific failure paths:

• tools=None could be passed through the Codex Responses preflight path
• transport errors such as httpx.RemoteProtocolError from responses.stream() were not handled inside _run_codex_stream()

That meant Codex stream failures could escape the inner recovery path instead of retrying/falling back cleanly.

Fix

• only include tools in normalized Codex kwargs when normalized_tools is not None
• treat Codex stream transport failures as transient in _run_codex_stream()
• retry once, then fall back to create(stream=True)

Verification

Added regression coverage in tests/test_streaming.py for:

• Codex text delta callback behavior
• Codex httpx.RemoteProtocolError fallback behavior

Local verification:

• pytest -q tests/test_streaming.py
• result: 20 passed

[teknium1]

Merged via PR #4313 — your commits were cherry-picked onto current main with authorship preserved. Both fixes verified with live E2E testing against the Codex API. Thanks for the contribution!