Preserve bio policy errors as a distinct non-retryable error (#46306)

## Why

Streaming `bio_policy` failures were classified as generic invalid requests, losing their policy-specific classification.

## What changed

- Add `BioPolicy` errors across the API and core protocol, recognizing streaming failures and HTTP 400 responses, including wrapped WebSocket errors.
- Preserve server messages and use a biological-risk fallback when the message is missing or blank.
- Treat bio policy errors as non-retryable in core and guardian handling, and classify them in diagnostics and telemetry.
- Map `BioPolicy` to `other` in the app-server v2 protocol.

## Testing

Add coverage for error classification, message preservation and fallbacks, HTTP and wrapped WebSocket responses, guardian retry decisions, and app-server conversion. Extend the core integration test to verify that bio policy failures emit a typed error and complete the turn after a single request.

GitOrigin-RevId: 78c2647e8fc8f80297cb8a23fff06ab141099632

codex-rs/codex-api/src/error.rs

@@ -35,6 +35,8 @@ pub enum ApiError {
     InvalidRequest { message: String },
     #[error("cyber policy: {message}")]
     CyberPolicy { message: String },
+    #[error("bio policy: {message}")]
+    BioPolicy { message: String },
     #[error("misalignment policy violation: {message}")]
     MisalignmentPolicyViolation {
         message: String,