Issue Summary

When using Bitbucket Agentic Pipelines with provider: codex, authenticating via the OPENAI_API_KEY secured environment variable fails during Codex session creation. The Codex ACP agent starts successfully and advertises supported auth methods, but immediately fails with a generic "Authentication required" JSON-RPC error before any agent task (e.g. PR review) runs — even though the same OpenAI API key is independently verified as valid and unrestricted.

Steps to Reproduce

1. In a Bitbucket Cloud repository/workspace with Agentic Pipelines and the Codex provider enabled, define an agent with provider: codex in bitbucket-pipelines.yml.
2. Add a valid OpenAI Platform API key as a secured Repository (or Workspace) variable named OPENAI_API_KEY.
3. Trigger a pipeline step that runs the Codex agent (script: - agent: <agent-name>).
4. Observe the Codex ACP agent (codex-acp 0.16.0) initialize, then fail immediately at session creation.

Expected Results

Codex ACP should accept OPENAI_API_KEY as a supported authentication method (as documented for Agentic Pipelines) and successfully create an authenticated session so the configured agent task can run.

Actual Results

The pipeline fails at Codex session creation, and no agent task/PR comment is produced:

{"agentCapabilities":{...},"agentInfo":{"name":"codex-acp","title":"Codex","version":"0.16.0"},"authMethods":[{"description":"Use your ChatGPT login with Codex CLI (requires a paid ChatGPT subscription)","id":"chatgpt","name":"Login with ChatGPT"},{"description":"Requires setting the `CODEX_API_KEY` environment var..."}]}
session creation error: {"code":-32000,"message":"Authentication required"}
{"type":"exception","message":"{\"code\":-32000,\"message\":\"Authentication required\"}"}

Workaround

Use the CODEX_ACCESS_TOKEN environment variable instead of OPENAI_API_KEY for Codex authentication in Agentic Pipelines. Generate a long-lived Codex access token (ensuring the Codex scope is included) and provide it as a secured Repository/Workspace variable named CODEX_ACCESS_TOKEN. This has been confirmed to allow the Codex ACP session to authenticate successfully where OPENAI_API_KEY does not.

Note: Codex access tokens require a ChatGPT Business or Enterprise workspace on the OpenAI side.