feat(agent): add OpenAI Responses API with auto endpoint detection

[tlongwell-block]

Summary

OpenAI's GPT-5 and o-series models on api.openai.com require the Responses API (/v1/responses) for tool calling; the legacy Chat Completions endpoint rejects them with unsupported_parameter. Meanwhile every OpenAI-compatible server in the wild (vLLM, Ollama, llama.cpp, OpenRouter, Block Gateway, Databricks) still speaks only Chat Completions. This change teaches sprout-agent both dialects and routes between them automatically.

New configuration

OPENAI_COMPAT_API={auto,chat,responses}   # default: auto

auto picks Responses when OPENAI_COMPAT_BASE_URL points at an *.openai.com host, and Chat Completions everywhere else. Operators can pin the choice explicitly for providers that diverge from the default (e.g. a Responses-compatible self-hosted gateway, or a *.openai.com host that for some reason needs the legacy endpoint).

Implementation

config.rs

• New OpenAiApi enum (ChatCompletions / Responses) on Config.
• parse_openai_api_env() parses OPENAI_COMPAT_API; auto_openai_api() picks per base_url.
• Zero-dep host extractor with a lookalike-safety test (api.openai.com.evil.example → Chat Completions, not Responses).

llm.rs

• Provider::OpenAi now dispatches on cfg.openai_api for both complete() and summarize().
• New responses_body + parse_responses (with responses_image_user_content, responses_stop helpers) handle the Responses wire shape:
  • Flat tool schema ({type, name, description, parameters} — no nested function: {…}).
  • input[] of typed items: typed user/assistant messages, function_call, function_call_output.
  • max_output_tokens (not max_tokens / max_completion_tokens).
  • Serializer emits each prior assistant function_call before its matching function_call_output — the API rejects with "No tool call found for call_id ..." otherwise (caught in live testing).
  • Parser walks output[], collects message content as text and function_call items as ToolCall. Skips reasoning items (stateless across turns; carrying them requires the encrypted-passthrough flow we don't need).
  • Stop mapping: incomplete + reason=max_output_tokens → MaxTokens; completed with function_call → ToolUse; completed otherwise → EndTurn.

README.md

• Provider table updated to show per-provider endpoint under auto.
• New env documented.

Tests

11 new unit tests (in llm.rs::tests and config.rs::tests), all passing:

• responses_body_top_level_shape — instructions/max_output_tokens/input; tools are flat; no stray messages/max_tokens/max_completion_tokens fields
• responses_body_replay_emits_function_call_before_output — pins the replay-ordering invariant
• responses_body_skips_empty_assistant_text — mirrors #559/#560 behavior; tool_calls still serialized
• responses_body_image_tool_result_attaches_input_image — image attachment via trailing input_image user message
• parse_responses_completed_with_text_is_end_turn
• parse_responses_completed_with_function_call_is_tool_use — also verifies reasoning items are skipped
• parse_responses_incomplete_max_output_tokens
• parse_responses_rejects_malformed_function_arguments
• auto_openai_api_picks_responses_for_official_openai
• auto_openai_api_picks_chat_for_third_parties — vLLM/Ollama/OpenRouter/Block Gateway/self-hosted vLLM/malformed input
• auto_openai_api_does_not_match_lookalike_hosts

Full suite: 58 pass, 0 fail. cargo fmt --all -- --check clean. cargo clippy -p sprout-agent --all-targets -- -D warnings clean.

Live smoke against api.openai.com with gpt-5-mini (key referenced only by filename, never read by the script):

=== auto + plain prompt (OPENAI_COMPAT_API=auto) ===
  stopReason=end_turn  tool_call=False  text='ready'
=== auto + tool prompt (OPENAI_COMPAT_API=auto) ===
  stopReason=end_turn  tool_call=True  text='It printed: hello'
=== chat + plain prompt (OPENAI_COMPAT_API=chat) ===
  stopReason=end_turn  tool_call=False  text='ready'

3/3 PASS — including a tool roundtrip through dev__shell that exercises the function_call → function_call_output replay ordering.

Not in this PR

• Reasoning passthrough. Reasoning items are dropped, not carried forward across turns. Sprout's flow is already stateless across turns; carrying encrypted reasoning state would be a separate change with its own privacy/storage considerations.
• Auto-fallback on Chat Completions errors. Suggested but rejected as too magical — operators with non-default endpoints set OPENAI_COMPAT_API explicitly, which keeps failure modes debuggable.
• Env rename. Kept the existing OPENAI_COMPAT_* env names for zero migration cost; "compat" reads a little awkwardly now that we natively call Responses, but every operator already configures them that way.

Blast radius

Anthropic path: unchanged. provider=openai with non-*.openai.com base_url: same Chat Completions wire as before. provider=openai with official OpenAI base_url: now uses Responses by default; operators can pin to chat if they need the old behavior.