Function resolve_codex_auth_config 

pub fn resolve_codex_auth_config(
    auth_mode: Option<&str>,
    legacy_inherit_user_config: bool,
    base_url: Option<String>,
    wire_api: Option<String>,
    provider_key_ref: Option<&str>,
    credentials: &[ScopedCredential],
    forward_env: &[String],
) -> Result<CodexAuthConfig, String>

Resolve and validate the public provision fields plus the one referenced provider credential carried in the in-memory secrets envelope.