Skip sandboxed shell commands in Guardian v2 by default (#39631)

## What changed

- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.

## Testing

- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.

GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b

codex-rs/features/src/tests.rs

@@ -162,6 +162,9 @@ max_action_tokens = 512
 max_classifier_instruction_tokens = 256
 max_parent_compaction_tokens = 384
 
+[guardianv2.review_scope]
+sandboxed_exec_commands = true
+
 [guardianv2.transcript]
 sources = ["tool_outputs", "reasoning"]
 include_images = true
@@ -185,6 +188,9 @@ max_recent_non_user_entries = 12
             max_action_tokens: Some(512),
             max_classifier_instruction_tokens: Some(256),
             max_parent_compaction_tokens: Some(384),
+            review_scope: Some(crate::GuardianV2ReviewScopeConfigToml {
+                sandboxed_exec_commands: Some(true),
+            }),
             transcript: Some(crate::GuardianV2TranscriptConfigToml {
                 sources: Some(vec![
                     crate::GuardianV2TranscriptSource::ToolOutputs,