Require automatic review for high-risk Guardian v2 actions (#38569)

## What changed

- Add a thread-scoped extension API for requesting automatic review, resolving
  multiple contributors to the strongest requirement.
- Have Guardian v2 request automatic review when it is enabled and the latest
  `action_risk` score is at least `0.8`.
- Honor extension review requirements across tool approvals, MCP elicitation,
  and remote execution while preserving host configuration and managed-policy
  constraints.

## Testing

- Cover contributor registration and requirement resolution.
- Verify Guardian v2 requests review at the threshold, returns to the default
  below it, and does not affect threads where the extension is disabled.
- Exercise extension-requested strict review with a remote model override.

GitOrigin-RevId: 6329fc23585d5cc7173c39bb9952c3109ec3884b

codex-rs/ext/extension-api/src/registry.rs

@@ -2,6 +2,8 @@ use std::sync::Arc;
 
 use codex_protocol::protocol::ReviewDecision;
 
+use crate::ApprovalPolicyContributor;
+use crate::ApprovalRequirement;
 use crate::ApprovalReviewContributor;
 use crate::ConfigContributor;
 use crate::ContextContributor;
@@ -33,6 +35,7 @@ impl<C: Sync> Default for ExtensionRegistryBuilder<C> {
                 config_contributors: Vec::new(),
                 token_usage_contributors: Vec::new(),
                 skill_invocation_contributors: Vec::new(),
+                approval_policy_contributors: Vec::new(),
                 approval_review_contributors: Vec::new(),
                 context_contributors: Vec::new(),
                 mcp_server_contributors: Vec::new(),
@@ -63,6 +66,11 @@ impl<C: Sync> ExtensionRegistryBuilder<C> {
         Arc::clone(&self.registry.event_sink)
     }
 
+    /// Registers one thread-scoped approval-policy contributor.
+    pub fn approval_policy_contributor(&mut self, contributor: Arc<dyn ApprovalPolicyContributor>) {
+        self.registry.approval_policy_contributors.push(contributor);
+    }
+
     /// Registers one approval-review contributor.
     pub fn approval_review_contributor(&mut self, contributor: Arc<dyn ApprovalReviewContributor>) {
         self.registry.approval_review_contributors.push(contributor);
@@ -153,6 +161,7 @@ pub struct ExtensionRegistry<C: Sync> {
     tool_contributors: Vec<Arc<dyn ToolContributor>>,
     tool_lifecycle_contributors: Vec<Arc<dyn ToolLifecycleContributor>>,
     turn_item_contributors: Vec<Arc<dyn TurnItemContributor>>,
+    approval_policy_contributors: Vec<Arc<dyn ApprovalPolicyContributor>>,
     approval_review_contributors: Vec<Arc<dyn ApprovalReviewContributor>>,
 }
 
@@ -187,6 +196,18 @@ impl<C: Sync> ExtensionRegistry<C> {
         &self.skill_invocation_contributors
     }
 
+    /// Resolves the strongest approval requirement for the current thread.
+    pub fn approval_requirement(&self, thread_store: &ExtensionData) -> ApprovalRequirement {
+        if self.approval_policy_contributors.iter().any(|contributor| {
+            contributor.approval_requirement(thread_store)
+                == ApprovalRequirement::RequireAutomaticReview
+        }) {
+            ApprovalRequirement::RequireAutomaticReview
+        } else {
+            ApprovalRequirement::Default
+        }
+    }
+
     /// Claims the first rendered approval-review prompt accepted by an
     /// installed contributor.
     pub async fn approval_review(