Support permission requests in direct Guardian review (#58903)

## What changed

Allow `guardian_review` to assess a final recorded `request_permissions` call without granting permissions. Build the review action using the same permission request preparation as live review, while continuing to reject earlier permission requests in the recorded history.

Return no assessment when the approval policy is `never` or granular policy disables permission requests.

## Testing

Add coverage comparing live and direct permission review inputs, plus tests that disallowed requests return no assessment without contacting the reviewer.

GitOrigin-RevId: cb5935202b0980e657b023f840a0186cea5e0b74

codex-rs/core/src/codex_thread.rs

@@ -931,7 +931,7 @@ impl CodexThread {
         Ok(())
     }
 
-    /// Review the final injected exec or native patch call without executing it.
+    /// Review the final injected exec, patch, or permission request without executing it.
     pub async fn guardian_review(
         &self,
         cancellation: &CancellationToken,
@@ -942,7 +942,8 @@ impl CodexThread {
         let history = self.session.clone_history().await;
         let tool_call = history.raw_items().next_back().cloned().ok_or_else(|| {
             CodexErr::InvalidRequest(
-                "expected a final plaintext exec_command or apply_patch call".into(),
+                "expected a final plaintext exec_command, apply_patch, or request_permissions call"
+                    .into(),
             )
         })?;
         crate::guardian::review_tool_call(&self.session, history, &tool_call, cancellation).await