Backport GPT-6-Astra model catalog to 0.153 (#42605)

## Why

The 0.153 release line needs the bundled GPT-6-Astra catalog update for
a 0.153.1 hotfix.

## What

- Add the hidden, API-supported GPT-6-Astra model entry with its
prompts, policies, and `unified_exec` shell type.
- Carry the accompanying catalog and test updates from the same change.
- Allowlist the enlarged bundled model catalog blob.

## ELI5

This teaches the 0.153 client how to configure GPT-6-Astra without
changing the visible default model.

## Validation

- `just fmt`
- `git diff --check`
- `just test -p codex-models-manager --lib
bundled_models_json_roundtrips`
- `just test -p codex-core --test all
guardian_session_prewarms_and_is_reused_for_first_review`
- `just test -p codex-tui --lib
status_model_provider_uses_bedrock_runtime_base_url_and_gates_usage_link`

.github/blob-size-allowlist.txt

@@ -5,6 +5,7 @@
 MODULE.bazel.lock
 codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
 codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
+codex-rs/models-manager/models.json
 codex-rs/tui/tests/fixtures/oss-story.jsonl
 codex-rs/tui_app_server/tests/fixtures/oss-story.jsonl
 codex-rs/tui/src/app.rs