fix(proxy): support Codex MCP tools in Responses

[felix-miao]

Summary

This fixes the Codex CLI -> Raven -> GitHub Copilot Responses compatibility gap for MCP tools. Codex is expected to use the OpenAI Responses API (/v1/responses) when configured with wire_api = "responses", but its tool payload can include shapes that Copilot Responses does not accept directly.

Problem

Before this change, Raven forwarded /v1/responses payloads to Copilot mostly as-is. That breaks Codex MCP usage in two related ways:

• Codex may include tool types that Copilot Responses rejects, such as image_generation, code_interpreter, file_search, mcp, computer_use_preview, and local_shell.
• Codex represents MCP servers as Responses namespace tools, for example mcp__teams__ with child function tools like ListChats. Copilot does not support type: "namespace", so forwarding these definitions unchanged can fail with unsupported-tool errors.
• MCP tool calls also need to round-trip correctly. If Raven only flattened the request but did not restore response function calls and next-turn history, Codex would not be able to route the tool call back to the right MCP namespace.

Fix

• Filter /v1/responses tools down to the tool types Copilot accepts: function and web_search_preview.
• Flatten Codex MCP namespace tool definitions into Copilot-compatible function tools, e.g. mcp__teams__ + ListChats becomes mcp__teams__ListChats.
• Keep a per-request mapping from flattened function names back to { namespace, name }.
• Restore flattened MCP function calls in both non-streaming JSON responses and streaming SSE chunks before returning them to Codex.
• Flatten namespaced function_call entries in next-turn input history so MCP tool-result continuations remain consistent when sent back upstream.

Behavior after this PR

Codex can continue using the correct Raven provider configuration with wire_api = "responses". MCP tools sent through the Responses API are normalized for Copilot on the upstream side and restored to Codex's expected namespace shape on the client side.

Testing

• bunx --bun vitest run packages/proxy/test/strategies/copilot-responses-tool-filter.test.ts packages/proxy/test/strategies/copilot-responses.test.ts packages/proxy/test/translate/upstream-compat-gaps.test.ts packages/proxy/test/routes/preprocess.test.ts packages/proxy/test/routes/messages-handler.test.ts packages/proxy/test/core/router.test.ts
• bun run --filter @raven/proxy typecheck
• bun run --filter @raven/proxy lint
• bun run scripts/gate-security.ts
• git push pre-push gates: security, coverage, arch passed