Use serving assessments for adaptive Guardian review (#58075)

## What changed

- Match final serving assessments to their response and output item, then retain them with tool invocations and code cells across waits.
- Use matching assessments instead of asynchronous scoring for adaptive review: low-risk actions can skip synchronous review, while elevated-risk actions require it.
- Revalidate captured authorization and policy before approval. Require fresh review for stale or incomplete authorization, preserve explicit review requirements, and discard assessments when hooks rewrite tool input.
- Keep asynchronous scoring as the fallback when an assessment is missing or does not match.

## Testing

Add integration coverage for direct and nested tool calls, hook rewrites, explicit escalation, interrupted responses, catalog-driven policy, incomplete authorization, and assessment retention across code-cell yields and waits.

GitOrigin-RevId: 4346a227204137f018c03c34b302d6f1e9592c96

codex-rs/ext/extension-api/src/contributors/approval_review.rs

@@ -32,6 +32,8 @@ pub trait SynchronousApprovalReviewer: Send + Sync {
 
 /// Inputs to Guardian's policy choice. Conversation and scores stay thread-owned.
 pub struct ApprovalDecisionInput<'a> {
+    /// Final serving value for this action. The host still requires fresh review when stale.
+    pub serving_assessment: Option<bool>,
     pub approval_id: &'a str,
     /// Host tool invocation being approved, absent for approvals without a tool call.
     pub tool_call_id: Option<&'a str>,

codex-rs/ext/extension-api/src/contributors/tool_lifecycle.rs

@@ -116,6 +116,9 @@ impl McpToolContext {
 
 /// Input supplied when the host starts executing one tool call.
 pub struct ToolStartInput<'a> {
+    /// Final serving assessment for the unchanged action, including its code cell's value.
+    /// When present, replaces asynchronous scoring; it does not grant execution permission.
+    pub serving_assessment: Option<bool>,
     /// Store scoped to the host session runtime.
     pub session_store: &'a ExtensionData,
     /// Store scoped to this thread runtime.