Replace Guardian tickets with parent response IDs (#43002)

## What changed

Capture the ID from `response.created` and pass it as `parent_response_id` in Guardian review and classifier request metadata. Clear the current response ID before sampling retries so tool reviews cannot inherit a failed response's ID.

Request Guardian credits with `guardian_credits_requested` on eligible parent requests. Remove the ticket protocol, transport attachment, and ticket-specific body redaction. Keep ordinary app-server client `parent_response_id` values inside `x-codex-turn-metadata` rather than promoting them to Guardian request metadata.

## Testing

Update coverage for HTTP fallback, WebSocket review reuse, missing response IDs, classifier transport retries, and code-mode yield/resume attribution. Extend app-server tests to verify client metadata placement over HTTP and WebSocket.

GitOrigin-RevId: c1665e56382ecec8d260fc2ca0ecd5e20b0b2391

codex-rs/codex-api/src/endpoint/responses.rs

@@ -60,8 +60,6 @@ pub struct ResponsesOptions {
     pub extra_headers: HeaderMap,
     pub compression: Compression,
     pub turn_state: Option<Arc<OnceLock<String>>>,
-    /// Runtime-only parent receipt, attached after inference tracing.
-    pub guardian_ticket: Option<codex_protocol::guardian_ticket::GuardianTicket>,
 }
 
 impl<T: HttpTransport> ResponsesClient<T> {
@@ -103,7 +101,7 @@ impl<T: HttpTransport> ResponsesClient<T> {
     )]
     pub async fn stream_request(
         &self,
-        mut request: ResponsesApiRequest,
+        request: ResponsesApiRequest,
         options: ResponsesOptions,
     ) -> Result<ResponseStream, ApiError> {
         let ResponsesOptions {
@@ -113,19 +111,9 @@ impl<T: HttpTransport> ResponsesClient<T> {
             extra_headers,
             compression,
             turn_state,
-            guardian_ticket,
         } = options;
-        crate::guardian_ticket::attach(
-            &mut request.client_metadata,
-            guardian_ticket.as_ref(),
-            self.endpoint,
-        );
-
-        let mut body = EncodedJsonBody::encode(&request)
+        let body = EncodedJsonBody::encode(&request)
             .map_err(|e| ApiError::Stream(format!("failed to encode responses request: {e}")))?;
-        if guardian_ticket.is_some() {
-            body = body.without_body_logging();
-        }
 
         let mut headers = extra_headers;
         if let Some(ref thread_id) = thread_id {

codex-rs/codex-api/src/endpoint/responses_websocket.rs

@@ -234,10 +234,9 @@ impl ResponsesWebsocketConnection {
     )]
     pub async fn stream_request(
         &self,
-        mut request: ResponsesWsRequest<'_>,
+        request: ResponsesWsRequest<'_>,
         connection_reused: bool,
         turn_state: Option<Arc<OnceLock<String>>>,
-        guardian_ticket: Option<&codex_protocol::guardian_ticket::GuardianTicket>,
     ) -> Result<ResponseStream, ApiError> {
         let (tx_event, rx_event) =
             mpsc::channel::<std::result::Result<ResponseEvent, ApiError>>(1600);
@@ -271,12 +270,6 @@ impl ResponsesWebsocketConnection {
             warmup: ws_request.generate == Some(false),
             connection_reused,
         };
-        let ResponsesWsRequest::ResponseCreate(ws_request) = &mut request;
-        crate::guardian_ticket::attach(
-            &mut ws_request.client_metadata,
-            guardian_ticket,
-            self.endpoint,
-        );
         let request_text = serialize_websocket_request(&request)?;
 
         let current_span = Span::current();