Preserve bio policy errors as a distinct non-retryable error (#46306)

## Why

Streaming `bio_policy` failures were classified as generic invalid requests, losing their policy-specific classification.

## What changed

- Add `BioPolicy` errors across the API and core protocol, recognizing streaming failures and HTTP 400 responses, including wrapped WebSocket errors.
- Preserve server messages and use a biological-risk fallback when the message is missing or blank.
- Treat bio policy errors as non-retryable in core and guardian handling, and classify them in diagnostics and telemetry.
- Map `BioPolicy` to `other` in the app-server v2 protocol.

## Testing

Add coverage for error classification, message preservation and fallbacks, HTTP and wrapped WebSocket responses, guardian retry decisions, and app-server conversion. Extend the core integration test to verify that bio policy failures emit a typed error and complete the turn after a single request.

GitOrigin-RevId: 78c2647e8fc8f80297cb8a23fff06ab141099632

codex-rs/protocol/src/error.rs

@@ -138,6 +138,8 @@ pub enum CodexErrorDetails {
     #[error("{message}")]
     CyberPolicy { message: String },
     #[error("{message}")]
+    BioPolicy { message: String },
+    #[error("{message}")]
     MisalignmentPolicyViolation {
         message: String,
         misalignment: Option<MisalignmentErrorDetails>,
@@ -394,6 +396,7 @@ impl CodexErr {
             | CodexErrorDetails::UsageLimitReached(_)
             | CodexErrorDetails::ServerOverloaded
             | CodexErrorDetails::CyberPolicy { .. }
+            | CodexErrorDetails::BioPolicy { .. }
             | CodexErrorDetails::MisalignmentPolicyViolation { .. } => false,
             CodexErrorDetails::Stream(..)
             | CodexErrorDetails::RateLimitExceeded(_)
@@ -439,6 +442,7 @@ impl CodexErr {
             | CodexErrorDetails::UsageNotIncluded => CodexErrorInfo::UsageLimitExceeded,
             CodexErrorDetails::ServerOverloaded => CodexErrorInfo::ServerOverloaded,
             CodexErrorDetails::CyberPolicy { .. } => CodexErrorInfo::CyberPolicy,
+            CodexErrorDetails::BioPolicy { .. } => CodexErrorInfo::BioPolicy,
             CodexErrorDetails::MisalignmentPolicyViolation { .. } => {
                 CodexErrorInfo::MisalignmentPolicyViolation
             }

codex-rs/protocol/src/protocol.rs

@@ -1858,6 +1858,7 @@ pub enum CodexErrorInfo {
     RateLimitExceeded,
     ServerOverloaded,
     CyberPolicy,
+    BioPolicy,
     MisalignmentPolicyViolation,
     HttpConnectionFailed {
         http_status_code: Option<u16>,
@@ -1899,6 +1900,7 @@ impl CodexErrorInfo {
             | Self::RateLimitExceeded
             | Self::ServerOverloaded
             | Self::CyberPolicy
+            | Self::BioPolicy
             | Self::MisalignmentPolicyViolation
             | Self::HttpConnectionFailed { .. }
             | Self::ResponseStreamConnectionFailed { .. }