Add native patch support to direct Guardian review (#58899)

## What changed

Allow `guardian_review` to assess recorded native `apply_patch` calls alongside `exec_command` calls. Use the existing patch preparation and approval logic without applying the patch, and skip assessment when approval is unnecessary.

## Testing

Add coverage that compares direct and live patch review inputs, verifies that an allow decision leaves files unchanged, and checks that writable files skip review without writes or model requests.

GitOrigin-RevId: 8634ad8c00a67bcac9e7930ebf89c02707c3a6f7

codex-rs/core/src/codex_thread.rs

@@ -931,7 +931,7 @@ impl CodexThread {
         Ok(())
     }
 
-    /// Review the final injected exec call if approval is required, without executing it.
+    /// Review the final injected exec or native patch call without executing it.
     pub async fn guardian_review(
         &self,
         cancellation: &CancellationToken,
@@ -941,7 +941,9 @@ impl CodexThread {
         }
         let history = self.session.clone_history().await;
         let tool_call = history.raw_items().next_back().cloned().ok_or_else(|| {
-            CodexErr::InvalidRequest("expected a final plaintext exec_command call".into())
+            CodexErr::InvalidRequest(
+                "expected a final plaintext exec_command or apply_patch call".into(),
+            )
         })?;
         crate::guardian::review_tool_call(&self.session, history, &tool_call, cancellation).await
     }