fix(openai): preserve tools on websocket transcript replacement

[DarkPaper2022]

Summary

• preserve prewarm additional_tools when a downstream Responses WebSocket request replaces incremental state with a full transcript
• keep replacement-provided tool declarations authoritative
• cover transcript replacement, unpinned replacement, and compact replay bypass paths with regression tests

Problem

Codex sends model-visible tool declarations in the WebSocket prewarm request. When resuming or forking an existing thread, the next request can carry a complete transcript and a prewarm previous_response_id while omitting additional_tools.

For an HTTP/SSE upstream, CLIProxyAPI cannot retain the synthetic prewarm response chain. It removes previous_response_id and forwards the replacement transcript, but previously discarded the prewarm tool declarations. The model then receives the full conversation without shell or other client tools and correctly reports that they are unavailable.

The fix prepends only the previous request additional_tools items when the replacement input does not already include them. It does not merge stale conversation items, and current declarations win when present.

Related reports:

• [CLI] All tools become unavailable after resuming a pre-upgrade session; /model restores them openai/codex#41265 describes the same user-visible loss of all tools after resume or fork through a custom Responses endpoint.
• Bug: Responses API WebSocket proxy sets previous_response_id=null, breaking multi-turn tool calls (Codex v0.118.0) #2596 covers the related WebSocket-to-HTTP previous_response_id continuity boundary.

Validation

• go test ./sdk/api/handlers/openai
• go test ./...
• go build -o test-output ./cmd/server
• real Codex 0.149.0 fork of an affected old session through a temporary v7.2.147 build: the reconstructed upstream request started with additional_tools containing the exec custom tool, and the model successfully invoked it to run pwd and print a sentinel.