Add managed command checkpoints requiring fresh human approval (#58045)

## Why

Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.

## What changed

- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.

## Testing

Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.

GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e

codex-rs/protocol/src/approvals.rs

@@ -275,6 +275,8 @@ pub struct GuardianAssessmentEvent {
 pub enum ExecApprovalKind {
     #[default]
     Command,
+    /// Requires a fresh human decision; automated and reusable approvals are invalid.
+    HumanCommand,
     WriteStdin,
 }
 

codex-rs/protocol/src/protocol.rs

@@ -1748,7 +1748,9 @@ impl EventMsg {
     pub fn command_approval_start(&self) -> Option<(&str, i64)> {
         match self {
             Self::ExecApprovalRequest(request)
-                if request.approval_id.is_none() && request.network_approval_context.is_none() =>
+                if request.kind == crate::approvals::ExecApprovalKind::Command
+                    && request.approval_id.is_none()
+                    && request.network_approval_context.is_none() =>
             {
                 Some((&request.call_id, request.started_at_ms))
             }