Preserve Guardian history across thread reconstruction (#42065)

## Why

Guardian review evidence must remain available after a compacted thread is resumed or forked, while rolled-back or parent-local evidence must not grant authorization in a different context.

## What changed

- Store the bounded, model-invisible Guardian transcript alongside compacted rollout history and restore it from the newest surviving checkpoint during replay.
- Trim Guardian history at rollback boundaries, clearing it when the boundary has already been evicted.
- Preserve the checkpoint for user-initiated forks, but remove it when spawning a subagent so parent review evidence is not inherited.
- Keep the new rollout field optional for compatibility with existing compacted records and legacy readers.

## Testing

- Cover Guardian history across compaction, restart, paginated and pathless stores, user forks, rollback, bounded replay, serialization, and subagent forks.

GitOrigin-RevId: 6ab076d5e0c3aac4d6a41ebd50ba2b200c90213e

codex-rs/tui/src/resume_picker_transcript_preview_tests.rs

@@ -73,6 +73,7 @@ fn legacy_transcript_preview_scans_tail_across_compaction() {
             RolloutItem::Compacted(CompactedItem {
                 message: String::from("summary that is not transcript text"),
                 replacement_history: None,
+                guardian_history: None,
                 mcp_resource_origins: None,
                 window_number: None,
                 first_window_id: None,
@@ -206,6 +207,7 @@ fn legacy_transcript_preview_falls_back_for_oversized_hidden_record() {
             RolloutItem::Compacted(CompactedItem {
                 message: "x".repeat(MAX_LEGACY_TRANSCRIPT_PREVIEW_SCAN_BYTES),
                 replacement_history: None,
+                guardian_history: None,
                 mcp_resource_origins: None,
                 window_number: None,
                 first_window_id: None,
@@ -235,6 +237,7 @@ fn legacy_transcript_preview_falls_back_when_scan_budget_is_exhausted() {
     let compacted = RolloutItem::Compacted(CompactedItem {
         message: "x".repeat(MAX_LEGACY_TRANSCRIPT_PREVIEW_SCAN_BYTES / 8),
         replacement_history: None,
+        guardian_history: None,
         mcp_resource_origins: None,
         window_number: None,
         first_window_id: None,