Summary

• add shared agent.responses_api helpers for Responses API message conversion
• route both run_agent.py and the auxiliary Codex adapter through the same conversion path
• convert assistant tool calls and tool outputs into function_call / function_call_output items instead of replaying raw role=tool messages
• add a regression test covering the auxiliary Responses adapter path

Problem

Hermes already had one correct Responses conversion path in run_agent.py, but agent/auxiliary_client.py still kept its own adapter logic.

That split was fragile: one path normalized tool transcripts correctly, while another could still replay chat-style role=tool messages into Responses input[]. Providers that implement the OpenAI Responses contract reject that shape with a 400 because tool is not a valid input role there.

Why this approach

This bug should not be fixed with another provider-specific patch.

The underlying problem was duplicated conversion logic across Responses-capable call paths. As long as those paths drift independently, custom gateways and Codex-compatible providers can regress in different ways.

This PR fixes it centrally by moving the conversion rules into shared helpers and making every Responses-capable path use the same normalization logic.

Testing

• env -u OPENAI_BASE_URL -u OPENAI_API_KEY -u OPENROUTER_API_KEY HOME=$(mktemp -d) ./venv/bin/pytest tests/agent/test_auxiliary_client.py::TestCodexResponsesAdapter::test_adapter_converts_tool_messages_to_function_call_output tests/test_run_agent_codex_responses.py -q

Closes #5709