merge(upstream): merge upstream/main into upstream-merge with policy

- Keep ours for  (resume picker not reintroduced)
- Initially took upstream for core, but reverted to ours to maintain API compatibility and pass build
- Adopted upstream elsewhere where non-conflicting
- Guard: keep codex-core re-exports and models alias intact
- Verify script: disable sccache outside GHA to allow local verify
- Fix: remove unused imports in theme selection view (warnings-as-failure policy)

Build: scripts/upstream-merge/verify.sh => build_fast=ok api_check=ok

scripts/upstream-merge/verify.sh

@@ -22,6 +22,12 @@ status_api="ok"
 
 # Use the same environment as the job (including sccache) for consistency
 export KEEP_ENV=1
+# If running outside a fully-provisioned GitHub Actions runner, sccache's GHA backend
+# can fail to start. In that case, disable sccache to allow local verification.
+if [[ -z "${ACTIONS_CACHE_URL:-}" || -z "${ACTIONS_RUNTIME_TOKEN:-}" ]]; then
+  export SCCACHE_DISABLE=1
+  unset RUSTC_WRAPPER CARGO_BUILD_RUSTC_WRAPPER SCCACHE SCCACHE_BIN
+fi
 if ! ./build-fast.sh 2>&1 | tee .github/auto/VERIFY_build-fast.log; then
   status_build="fail"
 fi