86cfd94b72
When forward_host_credentials is false, Codex bottles should still get tls_passthrough routes for the OpenAI/ChatGPT hosts so that tokens a user sets via `codex login` after launch aren't stripped by pipelock's header DLP. Previously no routes were emitted, which would have blocked those requests entirely once pipelock enforcement tightens. Rename the test to reflect the new expected behavior. Assisted-by: Claude Code