Preserve turn configuration in Guardian scoring and approvals (#59642)

## Why

Guardian scoring and cached approvals need to use the requesting turn's captured policy even when the live thread configuration changes. Newly tightened mandatory review requirements must still prevent cached approvals.

## What changed

- Pass captured turn configuration through tool lifecycle and approval review inputs, and use it to resolve Guardian policy and classifier instructions.
- Apply current reviewer and model requirements before scoring and cached approval, including rechecking restrictions after collecting score authorization.
- Count computer-use JavaScript execution attempts even when background scoring is disabled, so a synchronous call consumes the initial-call allowance.
- Retain runtime configuration snapshots when applying agent role overrides, and share Guardian policy text resolution between configuration loading and runtime publication.

## Testing

Add and extend regression coverage for captured policy instructions, reviewer restrictions, stale cached evidence, and a synchronous computer-use call followed by an adaptive turn.

GitOrigin-RevId: 24ed4a1b6ce1733ad775790f30e440da614f9cd6

codex-rs/thread-manager-sample/src/main.rs

@@ -272,6 +272,7 @@ async fn new_config(
         base_instructions: None,
         base_instructions_provenance: None,
         developer_instructions: None,
+        guardian_policy_revision: 0,
         guardian_policy_config: None,
         guardian_extra_policy: None,
         guardian_policy_template: None,