Persist Guardian V2 risk scores without restoring them (#40884)

## What changed

- Append accepted Guardian V2 classification results to rollout history for non-ephemeral threads.
- Keep resumed and forked threads from restoring a persisted score into active Guardian state.

## Testing

- Verify that asynchronous scoring records the resulting `SecurityRiskScore` rollout item.
- Seed resume and fork tests with a persisted score and verify that approvals ignore it.

GitOrigin-RevId: 40d63a2ea7e7cf6398402c6aed7d5e5727dc9d68

codex-rs/app-server/tests/suite/v2/guardian_v2.rs

@@ -1,3 +1,4 @@
+use std::io::Write;
 use std::sync::Arc;
 use std::sync::Mutex;
 use std::sync::atomic::AtomicUsize;
@@ -8,6 +9,7 @@ use anyhow::Result;
 use app_test_support::MockResponsesConfig;
 use app_test_support::TestAppServer;
 use app_test_support::create_fake_rollout;
+use app_test_support::rollout_path;
 use axum::Json;
 use axum::Router;
 use axum::extract::State;
@@ -571,14 +573,34 @@ async fn guardian_v2_routes_scoped_tool_approvals(
         | ThreadLifecycle::RootUserRestriction
         | ThreadLifecycle::RootUserInputRestriction
         | ThreadLifecycle::RootUserInputHookBlocked => None,
-        ThreadLifecycle::Resume | ThreadLifecycle::Fork => Some(create_fake_rollout(
-            codex_home.path(),
-            "2025-01-05T12-00-00",
-            "2025-01-05T12:00:00Z",
-            USER_CONTEXT,
-            Some("mock_provider"),
-            /*git_info*/ None,
-        )?),
+        ThreadLifecycle::Resume | ThreadLifecycle::Fork => {
+            let thread_id = create_fake_rollout(
+                codex_home.path(),
+                "2025-01-05T12-00-00",
+                "2025-01-05T12:00:00Z",
+                USER_CONTEXT,
+                Some("mock_provider"),
+                /*git_info*/ None,
+            )?;
+            let mut rollout = std::fs::OpenOptions::new().append(true).open(rollout_path(
+                codex_home.path(),
+                "2025-01-05T12-00-00",
+                &thread_id,
+            ))?;
+            writeln!(
+                rollout,
+                "{}",
+                json!({
+                    "timestamp": "2025-01-05T12:00:00Z",
+                    "type": "security_risk_score",
+                    "payload": {
+                        "scores": { "action_risk": 0.0 },
+                        "sampled_at": "2025-01-05T12:00:00Z",
+                    },
+                })
+            )?;
+            Some(thread_id)
+        }
     };
     let mut app_server = TestAppServer::builder()
         .with_codex_home(codex_home.path())
@@ -1143,7 +1165,7 @@ async fn guardian_v2_required_model_bypasses_scoring_and_runs_full_reviews() ->
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn resumed_thread_starts_without_guardian_score() -> Result<()> {
+async fn resumed_thread_ignores_persisted_guardian_score() -> Result<()> {
     skip_if_no_network!(Ok(()));
     guardian_v2_routes_tool_approvals(
         GuardianRisk::Low,
@@ -1156,7 +1178,7 @@ async fn resumed_thread_starts_without_guardian_score() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn forked_thread_starts_without_guardian_score() -> Result<()> {
+async fn forked_thread_ignores_persisted_guardian_score() -> Result<()> {
     skip_if_no_network!(Ok(()));
     guardian_v2_routes_tool_approvals(
         GuardianRisk::Low,