feat(auth): add caller-attested X.509 transport capability (#2428)

## Summary
- Add an isolated, preview `openai/auth/x509-transport` entrypoint for
one explicitly caller-attested Node.js Undici `Agent` or `ProxyAgent`.
- Freeze and privately brand each opaque transport generation; snapshot
its dispatcher; reject unsupported runtimes, executable getters,
JavaScript proxies, unknown options, plaintext targets, and per-request
dispatcher replacement without examining Undici private state.
- Keep Undici optional for ordinary SDK consumers and verify
installed-package CommonJS/ESM behavior with the optional peer both
absent and present.
- Exercise genuine direct mTLS and independently authenticated HTTPS
CONNECT, including distinct proxy/workload certificate authorities,
certificate fingerprints, proxy credential isolation, and
post-construction option mutation.

This is **PR 2 of 5**, following #2417. Certificate stability, safe
proxy TLS separation, and fresh-dispatcher rotation are application
attestations—not claims that transport identity cryptographically proves
certificate selection. OAuth exchange, OpenAI client integration,
credential caching, and lifecycle policy remain explicitly out of scope.

## Verification
- `pnpm install --frozen-lockfile --ignore-scripts`
- `pnpm lint`
- `pnpm exec tsc --noEmit`
- `pnpm build`
- `node --experimental-strip-types scripts/test-packed-package.ts` —
CommonJS, ESM, TypeScript 4.9/current, browser-safe source navigation,
and optional Undici absent/present
- Node 22.15.1, 22.22.0, 24.16.0, and 26.2.0: all 30 focused X.509 and
real-wire conformance tests pass
- `env NODE_USE_ENV_PROXY=0 CI=1 ./scripts/test
--testNamePattern='^(?!.*(?:pre-opened readable original inode|original
held inode)).*$'` — **4,064 handwritten tests passed; two pre-existing
Linux-only inode cases skipped on macOS; 559 generated tests and 12
snapshots passed**
- Exact-head Codex Security diff scan
`a3ac2b08-df37-44b8-9ba1-e105c884df5e` — complete changed-source
coverage, **zero findings**