Managed ChatGPT sign-in passes the access token to Codex app-server through
its launch environment, and the session manager kept reusing that process
after the token was renewed, so every turn failed with 401 token_expired
until T3 restarted.

Codex sessions now report when the token they launched with no longer
matches the current one (reading it refreshes a token near expiry). Before
reusing an idle session for a new turn, the session manager releases a stale
one, the same way idle release does, and the turn reopens app-server with
the renewed token and resumes the thread.

Fixes #16132

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>