Add managed command checkpoints requiring fresh human approval (#58045)

## Why

Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.

## What changed

- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.

## Testing

Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.

GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e

codex-rs/execpolicy/src/amend.rs

@@ -106,6 +106,11 @@ pub fn blocking_append_network_rule(
     let decision = serde_json::to_string(match decision {
         Decision::Allow => "allow",
         Decision::Prompt => "prompt",
+        Decision::PromptUser => {
+            return Err(AmendError::InvalidNetworkRule(
+                "prompt-user is only supported in managed command rules".to_string(),
+            ));
+        }
         Decision::Forbidden => "deny",
     })
     .map_err(|source| AmendError::SerializeNetworkRule { source })?;

codex-rs/execpolicy/src/decision.rs

@@ -9,8 +9,11 @@ use crate::error::Result;
 pub enum Decision {
     /// Command may run without further approval.
     Allow,
-    /// Request explicit user approval; rejected outright when running with `approval_policy="never"`.
+    /// Request approval from the configured reviewer; rejected with `approval_policy="never"`.
     Prompt,
+    /// Requires a fresh human decision, independent of the configured reviewer.
+    #[serde(rename = "prompt-user")]
+    PromptUser,
     /// Command is blocked without further consideration.
     Forbidden,
 }

codex-rs/execpolicy/src/policy.rs

@@ -215,7 +215,7 @@ impl Policy {
                     allowed.retain(|entry| entry != &rule.host);
                     upsert_domain(&mut denied, &rule.host);
                 }
-                Decision::Prompt => {}
+                Decision::Prompt | Decision::PromptUser => {}
             }
         }