Ignore stale Guardian tool risk scores (#39001)

## What changed

- Track the latest tool call and latest scored tool call for each Guardian v2 thread.
- Skip approval review when the score lags by more than `max_tool_call_lag` tool calls.
- Add `max_tool_call_lag` to the Guardian v2 configuration and schema, with a default of three.

## Testing

- Cover approval review at, above, and after recovering from the configured lag limit.
- Cover deserialization of `max_tool_call_lag`.

GitOrigin-RevId: fd870e143d95ee76491180e2aed742717248ff78

codex-rs/features/src/feature_configs.rs

@@ -120,6 +120,8 @@ pub struct GuardianV2ConfigToml {
     #[schemars(range(min = 0.0, max = 1.0))]
     pub review_threshold: Option<f64>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    pub max_tool_call_lag: Option<usize>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub reasoning_effort: Option<ReasoningEffort>,
     #[serde(skip_serializing_if = "Option::is_none")]
     #[schemars(range(min = 100, max = 100000))]

codex-rs/features/src/tests.rs

@@ -136,6 +136,7 @@ fn guardian_v2_feature_config_deserializes_classifier_and_transcript_settings()
 enabled = true
 classifier_instructions = "Review this action"
 review_threshold = 0.65
+max_tool_call_lag = 2
 reasoning_effort = "minimal"
 max_action_tokens = 512
 max_classifier_instruction_tokens = 256
@@ -159,6 +160,7 @@ max_recent_non_user_entries = 12
             enabled: Some(true),
             classifier_instructions: Some("Review this action".to_owned()),
             review_threshold: Some(0.65),
+            max_tool_call_lag: Some(2),
             reasoning_effort: Some(codex_protocol::openai_models::ReasoningEffort::Minimal),
             max_action_tokens: Some(512),
             max_classifier_instruction_tokens: Some(256),