Preserve approval policies for auto-reviewed models (#38439)

## What changed

- Keep the configured `approvalPolicy` when a model in
  `auto_review.required_on_models` selects the `auto_review` reviewer.
- Continue downgrading full-access sessions to workspace-write and rejecting
  incompatible reviewer overrides.

## Testing

- Cover supported approval policies across thread start, settings updates,
  turn-time model switches, resume, and fork flows.

GitOrigin-RevId: 2bd3e2dcd46f3cadeb2fad20222cf8917c267208

codex-rs/core/src/session/mod.rs

@@ -612,11 +612,6 @@ impl Session {
                     );
                 }
             }
-            config
-                .permissions
-                .approval_policy
-                .set(AskForApproval::OnRequest)
-                .map_err(|err| CodexErr::InvalidRequest(err.to_string()))?;
             config
                 .config_layer_stack
                 .requirements()