Track Guardian reviewer turn and tool analytics (#41023)

## Why

Trusted Guardian reviewer sessions can emit events without an app-server listener, leaving their turns and tool usage absent from analytics.

## What changed

- Translate Guardian session lifecycle and canonical tool item events into analytics notifications while excluding messages, reasoning, and review content.
- Preserve Guardian lineage during prewarming even when inherited client metadata is not yet available, without emitting an incomplete thread initialization event.
- Limit direct session tracking to trusted Guardian children so resumed threads that have an app-server listener do not report duplicate events.

## Testing

- Cover completed, failed, and interrupted Guardian turns, tool counts and timing, lineage, content exclusion, prewarmed lineage, and resumed-thread deduplication.

GitOrigin-RevId: 70ace5f7ed30a7e3b6a9d6097c8b2a6a326dc4f7

codex-rs/core/tests/suite/guardian_review.rs

@@ -145,10 +145,11 @@ async fn guardian_session_inherits_parent_http_fallback(
     );
 
     let server = start_mock_server().await;
-    Mock::given(method("GET"))
+    let websocket_fallback = Mock::given(method("GET"))
         .and(path_regex(".*/responses$"))
         .respond_with(ResponseTemplate::new(426))
-        .mount(&server)
+        .expect(1)
+        .mount_as_scoped(&server)
         .await;
 
     let responses = mount_sse_sequence(
@@ -189,6 +190,13 @@ async fn guardian_session_inherits_parent_http_fallback(
         });
     let test = builder.build_with_auto_env(&server).await?;
 
+    // Let startup prewarm observe the initial reviewer before enabling Guardian.
+    tokio::time::timeout(
+        Duration::from_secs(5),
+        websocket_fallback.wait_until_satisfied(),
+    )
+    .await?;
+
     test.codex
         .start_or_steer_turn(
             TurnInputRequest::user_input(vec![UserInput::Text {