fix: sanitize chat payloads and provider precedence

[adavyas]

Fixes #893

Summary

This PR prevents Codex-only replay metadata from leaking into chat-completions requests and fixes provider precedence regressions in the CLI. It also replaces a multiprocessing lock in a checkpoint test so sandboxed CI runners do not fail on SemLock permissions.

Changes

• sanitize outbound chat-completions messages by removing codex-only fields
• preserve original stored history for Codex Responses replay mode
• prefer saved config provider over stale environment override in CLI/provider resolution
• rename the skills command surface to skills-config in the touched branch changes
• switch checkpoint test lock usage from multiprocessing.Lock to threading.Lock

Validation

• pytest -q tests/test_provider_parity.py
• pytest -q tests/test_batch_runner_checkpoint.py
• pytest -q tests/test_cli_provider_resolution.py tests/test_runtime_provider_resolution.py tests/test_batch_runner_checkpoint.py tests/test_provider_parity.py

Notes

A full local suite run did not complete within the manual time caps used here, but the previously failing points were reproduced and fixed, and the focused touched-file test set passed.

[teknium1]

Opened salvage PR #1253 onto current main, preserving your authored commits for the substantive fixes. I omitted the stale redundant top-level \ rename because current main already uses . Thanks for the fixes and tests here.

[teknium1]

Correction: the omitted redundant rename was the top-level skills-config command surface; current main already uses the existing "hermes skills config" flow. Salvage PR is #1253.

[teknium1]

Merged via PR #1253. Your substantive commits were cherry-picked onto current main with authorship preserved where applicable. Thanks for the fix and tests.