Skip stale Guardian risk score persistence (#38612)

## Why

Concurrent Guardian samples can finish out of order. A stale result rejected by
the thread's latest-score update could still be appended to the rollout.

## What changed

Return without persisting a risk score when `insert_if` rejects it as older than
the score already stored on the thread.

GitOrigin-RevId: 7b2c895742753a19dfe48fd7f8ecd912d3cd3af6

codex-rs/ext/guardian-v2/src/extension.rs

@@ -382,11 +382,14 @@ impl ToolLifecycleContributor for GuardianV2Extension {
                     scores,
                     sampled_at: Some(sampled_at.into()),
                 };
-                thread
+                if !thread
                     .thread_extension_data()
                     .insert_if(score.clone(), |previous| {
                         previous.is_none_or(|previous| previous.sampled_at < score.sampled_at)
-                    });
+                    })
+                {
+                    return Ok(());
+                }
                 if !ephemeral {
                     thread
                         .append_rollout_items(&[RolloutItem::SecurityRiskScore(score)])