fix(usage): reseal sidecar OAuth attribution

[luvs01]

Motivation

• Sidecar OAuth failover updated the request-level label but did not reseal the persisted attempt identity, causing usage to be charged to the account that returned 429 instead of the account that served the retry.

Description

• Reseal the active usage attempt after a sidecar 429 rotation by calling sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, rotatedAdapter.name, logCtx.accountLogLabel) in the shared rotateSidecarProviderOn429 path in src/server/responses/core.ts so the attempt-level accountLogLabel matches the request-level label.
• Add an end-to-end regression in tests/oauth-account-attribution.test.ts that exercises a web-search sidecar failover with two stored OAuth accounts and asserts both the top-level and attempt-level attribution are stamped to the account that actually served the successful retry.
• Add a streaming Responses fixture completedStream() to support the sidecar streaming retry regression and update the test harness accordingly.

Testing

• Ran ./node_modules/.bin/bun test tests/oauth-account-attribution.test.ts and the file passed (new sidecar attribution test included).
• Ran bun run typecheck and bun run privacy:scan and both succeeded.
• Ran the full bun run test; the modified test passed, but the repository-wide suite surfaced unrelated pre-existing timing/state failures in some Lab and endpoint tests (these failures are not caused by this change).

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T05:37:10.540012Z	e52b834	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: 565ec613-59b0-4cab-bdee-ccaa54c5f4bb

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[luvs01]

상류 dev의 src/server/responses/core.ts가 sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, rotatedAdapter.name, logCtx.accountLogLabel)를 회전 어댑터 경로에 이미 포함합니다. 상류 커밋 6b508d5a8(lidge-jun#2608)로 반영되어 가치 소멸.