Add request-scoped Guardian approval decisions (#42807)

## What changed

- Extend `ApprovalReviewContributor` with a `decide` hook that can allow an
  action, return a synchronous review result, or hand the request to the user.
- Pass contributors the request's approval state and a callback bound to the
  existing synchronous reviewer. Review results satisfy the review gate while
  the host continues to enforce permissions.
- Add structured reasons for requesting a fresh Guardian review and select the
  first contributor decision in registration order.

GitOrigin-RevId: ec84474b3fcbcf1027c8502aa1c2947c10149f9d

codex-rs/ext/extension-api/src/registry.rs

@@ -241,6 +241,19 @@ impl<C: Sync> ExtensionRegistry<C> {
         None
     }
 
+    /// Returns the first claimed decision in registration order.
+    pub async fn decide_approval(
+        &self,
+        input: &crate::ApprovalDecisionInput<'_>,
+    ) -> Option<crate::ApprovalDecision> {
+        for contributor in &self.approval_review_contributors {
+            if let Some(decision) = contributor.decide(input).await {
+                return Some(decision);
+            }
+        }
+        None
+    }
+
     /// Returns the registered prompt contributors.
     pub fn context_contributors(&self) -> &[Arc<dyn ContextContributor>] {
         &self.context_contributors