Include policy approval reasons in Guardian reviews (#36939)

## Why

Guardian reviews received sandbox retry reasons, but not the execution-policy reason that triggered an initial approval request.

## What changed

- Propagate approval and retry reasons through the tool approval flow and include the applicable reason in the Guardian prompt.
- Prefer a sandbox retry reason when both are available.
- Truncate approval context to 512 tokens while preserving the start and end of the reason.

## Testing

Added prompt and integration coverage for policy reasons, retry precedence, and truncation.

GitOrigin-RevId: 5b0f4e1c40b792b031bc8f7b31685a61d12b8d92

codex-rs/core/src/mcp_tool_call.rs

@@ -1361,7 +1361,7 @@ async fn maybe_request_mcp_tool_approval(
             turn_context,
             review_id.clone(),
             build_guardian_mcp_tool_review_request(call_id, invocation, Some(metadata)),
-            /*retry_reason*/ None,
+            Default::default(),
         )
         .await;
         let decision = mcp_tool_approval_decision_from_guardian(decision);