Make Guardian risk score persistence opt-in (#40911)

## What changed

- Add the `features.guardianv2.persist_scores` configuration option for debugging.
- Default the option to `false`, so Guardian V2 reviewed actions and risk scores are only written to rollout files when explicitly enabled and the session is not ephemeral.

## Testing

- Cover configuration deserialization, default non-persistence, and opt-in persistence for nested code-mode actions.

GitOrigin-RevId: 452af99ef14553d45140340ececc2913389124d0

codex-rs/core/config.schema.json

@@ -1441,6 +1441,10 @@
           "minimum": 0.0,
           "type": "integer"
         },
+        "persist_scores": {
+          "description": "Persist reviewed actions and risk scores to rollout files for debugging.",
+          "type": "boolean"
+        },
         "reasoning_effort": {
           "$ref": "#/definitions/ReasoningEffort"
         },