Support direct Guardian review of recorded MCP calls (#59735)

## What changed

Extend `guardian_review` to assess recorded MCP tool calls using the current tool catalog, bindings, and approval policy without executing the call or remembering an approval. Return no assessment when policy or a remembered approval skips review, and reject tools blocked by app configuration.

## Testing

Add a scenario test that compares direct and live MCP review inputs, verifies that neither dispatches the tool, and checks that the current app approval policy can skip review.

GitOrigin-RevId: 05746dd0804a0f96d7946468701d5222171ff64f

codex-rs/core/src/codex_thread.rs

@@ -986,7 +986,7 @@ impl CodexThread {
         Ok(())
     }
 
-    /// Review the final injected exec, patch, or permission request without executing it.
+    /// Review the final injected tool call without executing it.
     pub async fn guardian_review(
         &self,
         cancellation: &CancellationToken,
@@ -997,7 +997,7 @@ impl CodexThread {
         let history = self.session.clone_history().await;
         let tool_call = history.raw_items().next_back().cloned().ok_or_else(|| {
             CodexErr::InvalidRequest(
-                "expected a final plaintext exec_command, apply_patch, or request_permissions call"
+                "expected a final plaintext exec_command, apply_patch, request_permissions, or MCP call"
                     .into(),
             )
         })?;