Skip remote Git discovery for Guardian diff paths (#49082)

## Why

An offline secondary executor can stall Guardian approval revalidation while diff display setup searches for Git roots, even when the review concerns another executor.

## What changed

Use each environment's working directory as the diff display root for Guardian sessions, regardless of `CwdRelativeTurnDiffs`, so this setup does not wait for remote Git discovery.

## Testing

Add a regression test that withdraws authorization during a pending approval and disconnects an unrelated secondary executor. Verify that Guardian retries with the updated authorization and denies the request.

GitOrigin-RevId: 3661759119935c68539e9eab8df2e862987d0d92

codex-rs/core/src/session/turn.rs

@@ -282,11 +282,13 @@ pub(crate) async fn run_turn(
     let (world_state, display_roots) = tokio::join!(
         sess.record_context_updates_and_set_reference_context_item(first_step_context.as_ref()),
         async {
-            if first_step_context
-                .turn
-                .config
-                .features
-                .enabled(Feature::CwdRelativeTurnDiffs)
+            // Guardian must not wait for remote Git discovery just to display diff paths.
+            if crate::guardian::is_basic_session_source(&turn_context.session_source)
+                || first_step_context
+                    .turn
+                    .config
+                    .features
+                    .enabled(Feature::CwdRelativeTurnDiffs)
             {
                 first_step_context
                     .environments