Harden Guardian reviews after context compaction (#42852)

## Why

Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.

## What changed

- Retain bounded excerpts of oversized root user messages across compaction,
  resume, and rollback, and recover excerpts from legacy Guardian history when
  available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
  reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
  is disabled, compatibility is unknown, or checkpoint content is unusable.

## Testing

Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.

GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e

codex-rs/core/src/session/mod.rs

@@ -1591,10 +1591,7 @@ impl Session {
             );
             state
                 .history
-                .restore_guardian_history(guardian_history.as_ref());
-            state
-                .history
-                .restore_retained_context(Some(&retained_context));
+                .restore_review_context(Some(&retained_context), guardian_history.as_ref());
             if let Some(world_state) = world_state_baseline {
                 state.history.set_world_state_baseline(world_state);
             }

codex-rs/core/src/session/rollout_reconstruction.rs

@@ -347,8 +347,10 @@ impl Session {
             && let Some(items) = &checkpoint.compacted.replacement_history
         {
             history.replace_annotated(items.clone());
-            history.restore_guardian_history(checkpoint.compacted.guardian_history.as_ref());
-            history.restore_retained_context(checkpoint.compacted.retained_context.as_ref());
+            history.restore_review_context(
+                checkpoint.compacted.retained_context.as_ref(),
+                checkpoint.compacted.guardian_history.as_ref(),
+            );
         }
         // Materialize exact history semantics from the replay-derived suffix. The eventual lazy
         // design should keep this same replay shape, but drive it from a resumable reverse source