auth: openai_responses provider for Codex subscription (Tier 2)

Add the OpenAI Responses API wire dialect (openai_responses APIStyle +
OpenAIResponsesConfig), a request serializer (instructions/input items,
flat function tools, reasoning, store:false, include encrypted reasoning),
and a streaming state machine over the typed response.* SSE events mapping
to the shared block model. Wire dispatch, buildProviderConfig, the C-ABI
free switch, and the reasoning selectors. Ship a commented Codex example in
the default config.

Implemented from the Responses API docs + the open-source Codex client and
covered by fixture tests; live verification against a ChatGPT plan is still
required (documented).

1 files changed, 12 insertions, 0 deletions

diff --git a/libpanto/src/provider.zig b/libpanto/src/provider.zig
index 43c882a..9c715b7 100644
--- a/libpanto/src/provider.zig
+++ b/libpanto/src/provider.zig
@@ -290,6 +290,7 @@ pub fn openStream(
     // provider.zig <- provider_openai_chat.zig <- provider.zig.
     const provider_openai_chat = @import("provider_openai_chat.zig");
     const provider_anthropic_messages = @import("provider_anthropic_messages.zig");
+    const provider_openai_responses = @import("provider_openai_responses.zig");
     const client = config_mod.httpClient();
     switch (cfg.provider) {
         .openai_chat => |*c| {
@@ -314,6 +315,17 @@ pub fn openStream(
             const rr = try req.open(conv, registry);
             return rr.providerStream();
         },
+        .openai_responses => |*c| {
+            var req: provider_openai_responses.OpenAIResponsesRequest = .{
+                .allocator = allocator,
+                .io = io,
+                .config = c,
+                .http_client = client,
+                .diag = diag,
+            };
+            const rr = try req.open(conv, registry);
+            return rr.providerStream();
+        },
     }
 }