core: stabilize synthesized call output IDs

[bolinfest]

Why

Response item IDs represent stable conversation identity. ContextManager::for_prompt repairs an unmatched call by synthesizing an "aborted" output in the disposable prompt projection, but that output previously had no ID. Assigning a fresh ID on every prompt build would make retries and resumes change otherwise identical model context and reduce prompt-cache reuse.

The concrete bug is that these normalization-created outputs bypass the regular item-ID allocation path. Even with item IDs enabled, a prompt could therefore contain an identified call paired with a synthetic output whose id was missing. This change closes that gap by deriving the output ID from the source call's item ID. For legacy calls that have no item ID, the output remains ID-less because there is no stable source identity to derive from.

The originating call already has a stable item ID under the item-ID model introduced in #28814. A prompt-only output can therefore derive stable identity from that call without mutating canonical history or persisted rollouts. This addresses the failure exposed by #30311 while keeping normalization read-only outside its detached prompt snapshot.

UUIDv5 is intentional here because it is the standard namespaced, deterministic UUID construction. Using the output kind and source call ID as the name produces the same UUID on every projection while keeping output kinds in separate name domains. UUIDv7 would introduce randomness and time, so keeping it stable would require persisting the synthetic repair. UUIDv5 uses SHA-1 internally, but this is only an identity mapping—not an authenticity or security boundary.

What changed

• Derive a deterministic UUIDv5 ID for each synthesized call output from the source call item ID.
• Use the Responses API prefix appropriate for function, custom-tool, tool-search, and local-shell outputs.
• Preserve the existing insertion position immediately after the unmatched call.
• Keep synthesized outputs prompt-only; no rollout, task-lifecycle, compaction, or raw-response behavior changes.

Testing

• just test -p codex-core for_prompt_assigns_stable_id_to_synthetic_output_without_reordering_history
• just test -p codex-core synthetic_call_output_id_is_stable_across_resumes
• just test -p codex-core normalize_adds_missing_output
• just test -p codex-core response_item_ids

[rka-oai]

Reviewed - LGTM. Pretty funny how many places we've had to handle for item_id