The Codex api-key auth-request check ran on the run's explicit env,
before the launch merged the projected host environment in. A local
Codex launch could inherit OPENAI_API_KEY or CODEX_API_KEY from the
host after that check, so the launched process had the credential but
never got the required api-key authentication request.
Move the check into resolveRuntimeEnv, after the host projection and
explicit env merge produce the final environment. This covers every
launch path (local, runner-less fallback, remote sandbox), because
they all resolve their launch env through this one function.
Co-authored-by: Paperclip <noreply@paperclip.ing>
c2e517d948