fix(openai): preserve Codex image function tools during bridge injection

[xiaohei210509]

Summary

• recognize Codex client image tools serialized as flat or nested image_gen.imagegen functions
• skip hosted image_generation, automatic tool_choice, and hosted-bridge instructions when that client function is already present
• add helper, HTTP forwarding, and WebSocket ingress regression coverage

Root cause

PR #4104 made bridge injection reuse the image-tool detector for hosted tools and namespace/image_gen declarations. Some Codex clients and MCP adapters instead serialize the same client-side tool as one of these function shapes:

{"type":"function","name":"image_gen.imagegen"}
{"type":"function","function":{"name":"image_gen.imagegen"}}

Those forms are not OpenAI hosted tools and are intentionally not part of hasOpenAIImageGenerationTool. As a result, the bridge still appended a hosted image_generation tool to the same request, which OpenAI rejects with:

Function 'image_gen.imagegen' conflicts with a hosted tool in the same request.

This change reuses the existing exact-name function parser before applying any hosted bridge additions. Similar names such as image_gen.imagegenerator continue through the existing injection path.

This is a follow-up to #4104. Refs #4022 and #4249.

Validation

• targeted helper, HTTP, and WebSocket regression tests
• go test ./internal/service -count=1
• go test ./... -count=1
• go test -tags=unit ./... -count=1
• go test -tags=integration across all packages except internal/pkg/tlsfingerprint
• golangci-lint run ./... --timeout=30m (0 issues)

The full integration command was also run. Its only failure was the unrelated external TLS fingerprint endpoint intermittently returning unexpected EOF; all remaining integration packages passed locally.

[github-actions]

All contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[xiaohei210509]

I have read the CLA Document and I hereby sign the CLA