fix: fall back after Codex WebSocket handshake errors

[ereinach]

Rationale

A Codex WebSocket handshake that returns a transient HTTP error currently escapes as a raw aiohttp exception. That bypasses the documented Codex stream retry and HTTP fallback behavior and aborts otherwise recoverable agent steps.

Summary

• Reproduction: return HTTP 503 from the Codex WebSocket handshake endpoint.
• Violated behavior: CodexWSLM with ws_fallback enabled does not reach the HTTP fallback because WSServerHandshakeError escapes the transport.
• Root cause: the transport normalized only HTTP 401; every other handshake status was re-raised unchanged.
• Fix: normalize non-401 handshake failures as CodexStreamError while preserving the HTTP status and Retry-After metadata.
• Coverage: add a regression test proving that HTTP 503 becomes a retryable Codex stream failure. The existing 401 auth-expiry behavior remains unchanged.

Test plan

• uv run pytest tests/test_codex_ws_lm.py::test_codex_wslm_websocket_503_is_retryable_stream_error tests/test_codex_ws_lm.py::test_codex_wslm_websocket_401_is_codex_lm_auth_expired tests/codex_lm/test_ws_lm.py::test_ws_fallback_exhaustion_routes_later_invocations_to_http -q --disable-warnings
• uv run pytest tests/test_codex_ws_lm.py tests/codex_lm/test_ws_lm.py -q --disable-warnings
• uv run ruff check src/codex-lm/dspy_codex_lm/lm.py tests/test_codex_ws_lm.py
• git diff --check