fix(codex): switch provider gateways transactionally

[WilliamDee-Huang]

Summary

• Start a provider gateway candidate in an isolated sidecar directory and random port.
• Validate the candidate before committing profile configuration and model catalog changes.
• Restore the profile snapshot on commit failure and only replace the previous runtime after the candidate is ready.
• Avoid stopping the active provider gateway before a replacement is available during account and instance switching.

Validation

• cargo fmt --all -- --check
• COCKPIT_SKIP_CLIPROXY_BUILD=1 cargo test -p cockpit-tools provider_gateway -- --nocapture (29 passed)

Review note

The candidate validation currently includes a small non-streaming Responses request to verify upstream connectivity. This is intentionally called out for review because it can consume provider quota; it may be preferable to make that check explicit or replace it with a non-billing health check.