Pass usage_signature through to RolloutOutput

[shayonj]

Summary

Small change to pass the HMAC usage signature from vLLM responses through to the orchestrator for tamper detection.

When the vLLM ASGI middleware signs token usage data (added in the prime-rl companion PR), the signature is injected as usage_signature in the chat completion response JSON. This PR ensures that field survives the verifiers pipeline:

• types.py — add optional usage_signature field to Response and TokenUsage
• openai_chat_completions_client.py — extract usage_signature from the OpenAI SDK response's model_extra
• save_utils.py — forward the last trajectory response's signature into RolloutOutput.token_usage

3 files, 20 lines. No behavior change when the middleware isn't active (field is simply absent).

Companion PRs: platform#913 · prime-rl#2042 · hosted-rl#862

---

Note

Low Risk
Low risk: adds an optional metadata field and pass-through logic without changing token counting or request/response behavior when the field is absent.

Overview
Propagates an optional usage_signature value from model chat completion responses into serialized rollout outputs for downstream tamper detection.

This extends Response/TokenUsage with usage_signature, extracts it from the OpenAI SDK response (including model_extra), and injects the most recent trajectory signature into RolloutOutput.token_usage when present.

^{Written by Cursor Bugbot for commit 34e861c. This will update automatically on new commits. Configure here.}