Preserve approval policies for auto-reviewed models (#38439)

## What changed

- Keep the configured `approvalPolicy` when a model in
  `auto_review.required_on_models` selects the `auto_review` reviewer.
- Continue downgrading full-access sessions to workspace-write and rejecting
  incompatible reviewer overrides.

## Testing

- Cover supported approval policies across thread start, settings updates,
  turn-time model switches, resume, and fork flows.

GitOrigin-RevId: 2bd3e2dcd46f3cadeb2fad20222cf8917c267208

codex-rs/core/src/session/session.rs

@@ -260,8 +260,7 @@ impl SessionConfiguration {
             return Ok(());
         }
 
-        if self.approval_policy.value() == AskForApproval::OnRequest
-            && self.approvals_reviewer == ApprovalsReviewer::AutoReview
+        if self.approvals_reviewer == ApprovalsReviewer::AutoReview
             && !self
                 .file_system_sandbox_policy(environments)
                 .has_full_disk_write_access()
@@ -350,21 +349,15 @@ impl SessionConfiguration {
                 .config_layer_stack
                 .requirements()
                 .auto_review_required_for_model(next_configuration.collaboration_mode.model())
+            && updates.approvals_reviewer.is_none()
         {
-            if updates.approval_policy.is_none() {
-                next_configuration
-                    .approval_policy
-                    .set(AskForApproval::OnRequest)?;
-            }
-            if updates.approvals_reviewer.is_none() {
-                next_configuration
-                    .original_config_do_not_use
-                    .config_layer_stack
-                    .requirements()
-                    .approvals_reviewer
-                    .can_set(&ApprovalsReviewer::AutoReview)?;
-                next_configuration.approvals_reviewer = ApprovalsReviewer::AutoReview;
-            }
+            next_configuration
+                .original_config_do_not_use
+                .config_layer_stack
+                .requirements()
+                .approvals_reviewer
+                .can_set(&ApprovalsReviewer::AutoReview)?;
+            next_configuration.approvals_reviewer = ApprovalsReviewer::AutoReview;
         }
         if let Some(windows_sandbox_level) = updates.windows_sandbox_level {
             next_configuration.windows_sandbox_level = windows_sandbox_level;