Add Guardian internal session support (#39994)

## What changed

- Add an extension API for spawning host-owned internal sessions and a
  `ThreadReadyInput` lifecycle callback that runs after thread registration.
- Add Guardian reviewer session scaffolding that records the parent thread and
  effective model, plus the under-development `guardian_ext` feature flag.
- Start internal sessions with fresh history while preserving parent lineage,
  shared session controls, and internal-thread visibility rules.
- Scope internal-session prompt cache keys to their source and parent thread,
  and expose `guardian` as an internal session source.

## Testing

- Cover internal-session spawning, parent metadata, history isolation, prompt
  cache keys, and extension spawner argument forwarding.

GitOrigin-RevId: 682dae80397d62bb36247796b447042e760ca364

codex-rs/cli/src/doctor/thread_inventory.rs

@@ -674,6 +674,7 @@ fn source_category(source: &str) -> &'static str {
         SessionSource::Internal(InternalSessionSource::MemoryConsolidation) => {
             "internal:memory_consolidation"
         }
+        SessionSource::Internal(InternalSessionSource::Guardian) => "internal:guardian",
         SessionSource::SubAgent(SubAgentSource::Review) => "subagent:review",
         SessionSource::SubAgent(SubAgentSource::Compact) => "subagent:compact",
         SessionSource::SubAgent(SubAgentSource::ThreadSpawn { .. }) => "subagent:thread_spawn",