fix(codex): allow backend responses image_generation tools

[choi138]

Summary

Recent Codex clients advertise a top-level image_generation tool on /backend-api/codex/responses. codex-lb still routes backend Codex Responses payloads through shared request validation, so those requests fail locally with invalid_request_error before they reach the upstream service.

This change keeps the fix backend-Codex-specific by introducing route-scoped built-in tool validation. Backend Codex Responses requests can advertise image_generation, while /v1/responses and /v1/chat/completions remain strict.

What Changed

• added validation-context plumbing to shared Responses request normalization so routes can explicitly allow selected built-in tool types
• updated backend HTTP /backend-api/codex/responses and /internal/bridge/responses handling to normalize raw payloads with the backend-only image_generation allowance
• passed the same backend-only allowance through websocket response.create preparation for /backend-api/codex/responses
• kept /v1/responses validation strict and preserved existing tool alias normalization such as web_search_preview
• added regression coverage for backend HTTP/websocket acceptance and continued /v1 rejection
• added the matching OpenSpec change under openspec/changes/support-codex-image-generation-tool

Impact

• /backend-api/codex/responses now accepts and forwards {"type":"image_generation"} unchanged
• internal bridge owner handoff no longer reintroduces the same validation failure for backend Codex traffic
• /v1/* behavior is unchanged

Validation

• openspec validate --specs
• .venv/bin/python -m pytest tests/unit/test_openai_requests.py tests/integration/test_proxy_responses.py tests/integration/test_proxy_websocket_responses.py -q