chore(core) rm AskForApproval::OnFailure (#28418)

## Summary
Deletes the OnFailure variant of the `AskForApproval` enum. This option
has been deprecated since #11631.

## Testing
- [x] Tests pass

codex-rs/app-server-protocol/src/protocol/v2/shared.rs

@@ -163,7 +163,6 @@ pub enum AskForApproval {
     #[serde(rename = "untrusted")]
     #[ts(rename = "untrusted")]
     UnlessTrusted,
-    OnFailure,
     OnRequest,
     #[experimental("askForApproval.granular")]
     Granular {
@@ -182,7 +181,6 @@ impl AskForApproval {
     pub fn to_core(self) -> CoreAskForApproval {
         match self {
             AskForApproval::UnlessTrusted => CoreAskForApproval::UnlessTrusted,
-            AskForApproval::OnFailure => CoreAskForApproval::OnFailure,
             AskForApproval::OnRequest => CoreAskForApproval::OnRequest,
             AskForApproval::Granular {
                 sandbox_approval,
@@ -206,7 +204,6 @@ impl From<CoreAskForApproval> for AskForApproval {
     fn from(value: CoreAskForApproval) -> Self {
         match value {
             CoreAskForApproval::UnlessTrusted => AskForApproval::UnlessTrusted,
-            CoreAskForApproval::OnFailure => AskForApproval::OnFailure,
             CoreAskForApproval::OnRequest => AskForApproval::OnRequest,
             CoreAskForApproval::Granular(granular_config) => AskForApproval::Granular {
                 sandbox_approval: granular_config.sandbox_approval,

codex-rs/app-server-protocol/src/protocol/v2/tests.rs

@@ -195,7 +195,7 @@ fn thread_resume_response_round_trips_initial_turns_page() {
         cwd: absolute_path("tmp"),
         runtime_workspace_roots: Vec::new(),
         instruction_sources: Vec::new(),
-        approval_policy: AskForApproval::OnFailure,
+        approval_policy: AskForApproval::OnRequest,
         approvals_reviewer: ApprovalsReviewer::User,
         sandbox: SandboxPolicy::DangerFullAccess,
         active_permission_profile: None,
@@ -3689,7 +3689,7 @@ fn thread_lifecycle_responses_default_missing_optional_fields() {
         "modelProvider": "openai",
         "serviceTier": null,
         "cwd": absolute_path_string("tmp"),
-        "approvalPolicy": "on-failure",
+        "approvalPolicy": "on-request",
         "approvalsReviewer": "user",
         "sandbox": { "type": "dangerFullAccess" },
         "reasoningEffort": null