Why the big diff

the extra safety is specifically required for concurrent Codex conversations.

  The regular SaasSecretsStore loads and replaces the entire secret set. It does not provide per-secret compare-and-swap. That creates two Codex-specific problems:

  - OpenAI refresh tokens rotate. Two conversations cannot safely refresh the same token concurrently.
  - A stale settings save could replace a newer CODEX_AUTH_JSON written by another conversation.

  The new flow therefore has three protections:

  - Redis serializes upstream refreshes.
  - CodexAuthStore updates only CODEX_AUTH_JSON using a digest and row lock.
  - The regular store leaves an unchanged Codex row intact, preventing bulk secret saves from overwriting a newer rotation.

A smaller scope PR github.com/OpenHands/OpenHands/pull/15287 The bis PR keeps the same Codex broker behavior and safety fixes: concurrent refresh serialization, CAS updates, stale-write protection, revocation, and request limits for codex only. The difference is persistence scope: - CODEX_AUTH_JSON gets the special row-lock/digest protections. - Every other custom secret continues through the original bulk SaasSecretsStore behavior. - There is no global uniqueness migration, generic snapshot/diff logic, or generic upsert behavior. So it preserves the Codex functionality while avoiding changes to the semantics or risk surface of unrelated secrets.

@calm-artist-7206 ideally i'd like the sdk release to contain this 😅 but we can cut it sooner if the acp fix is time sensitive