WARE-176: rotate on empty OpenAI chat completion

[warelik]

Summary

First narrow slice of #4881: treat an empty OpenAI chat-completions success as a retriable auth failure and rotate to the next credential on non-streaming Execute.

Parent #4881 stays open. This PR does not replace it.

Semantic emptiness for this slice (OpenAI choices only):

• empty / whitespace / JSON null body
• {"choices":[]}
• content:"" with finish_reason: stop and zero completion_tokens
• tool-call skeleton (id only, no name/arguments)
• SSE [DONE] with no content

Not empty: visible text, refusal, named tool-call, audio, images, completion_tokens > 0. Other wire formats (Claude, Gemini, Responses, Interactions) are out of scope and are not classified as empty here.

Size

3 files, +854 / −0 vs dev. Over the ~400-line target because the OpenAI semantic detector is one compilable unit: splitting the detector from the Execute hook leaves an unused library; dropping skeleton tool-calls reopens a named false-life hole. Tests fail on current dev and pass after this change.

Cutoff

The finding set for this artifact is closed. Further auto-review rounds will be recorded and not actioned, except the closed list: secret leak, data loss, resource leak, compatibility break. This artifact is ready for maintainer review.

Follow-up slices of #4881: stream+drain, Claude, Gemini+signature-only, Responses/Interactions, pluginhost, in-band error redaction, remaining glue.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c52de4283f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".