Make Guardian risk score persistence opt-in (#40911)

## What changed

- Add the `features.guardianv2.persist_scores` configuration option for debugging.
- Default the option to `false`, so Guardian V2 reviewed actions and risk scores are only written to rollout files when explicitly enabled and the session is not ephemeral.

## Testing

- Cover configuration deserialization, default non-persistence, and opt-in persistence for nested code-mode actions.

GitOrigin-RevId: 452af99ef14553d45140340ececc2913389124d0

codex-rs/ext/guardian-v2/src/async_scorer/config.rs

@@ -33,6 +33,7 @@ pub(crate) enum GuardianV2ReviewScope {
 #[derive(Clone, Debug, PartialEq)]
 pub(crate) struct GuardianV2Config {
     local_overrides: GuardianV2ConfigToml,
+    pub(crate) persist_scores: bool,
     pub(crate) classifier_instructions: String,
     pub(crate) review_threshold: f64,
     pub(crate) max_tool_call_lag: usize,
@@ -229,6 +230,7 @@ impl GuardianV2Config {
 
         Ok(Self {
             local_overrides: configured.clone(),
+            persist_scores: configured.persist_scores.unwrap_or(false),
             classifier_instructions: configured
                 .classifier_instructions
                 .unwrap_or_else(|| DEFAULT_CLASSIFIER_INSTRUCTIONS.to_owned()),

codex-rs/ext/guardian-v2/src/async_scorer/extension.rs

@@ -804,7 +804,8 @@ impl GuardianV2Extension {
                     .latest_scored_tool_call
                     .fetch_max(tool_call_index, Ordering::Release);
                 classification_finished_at = Some(Instant::now());
-                if !config.ephemeral
+                if guardian_config.persist_scores
+                    && !config.ephemeral
                     && let Err(error) = thread
                         .append_rollout_items(&[RolloutItem::SecurityRiskScore(score)])
                         .await

codex-rs/ext/guardian-v2/src/async_scorer/extension_tests.rs

@@ -1770,26 +1770,16 @@ async fn contributor_samples_tool_calls_with_the_existing_luna_pool() -> Result<
     );
     assert!(score.sampled_at.is_some());
     test.codex.ensure_rollout_materialized().await;
-    let persisted_score = tokio::time::timeout(Duration::from_secs(5), async {
-        loop {
-            if let Some(persisted_score) = test
-                .codex
-                .load_history(/*include_archived*/ false)
-                .await?
-                .items
-                .into_iter()
-                .find_map(|item| match item {
-                    RolloutItem::SecurityRiskScore(score) => Some(score),
-                    _ => None,
-                })
-            {
-                return Ok::<_, anyhow::Error>(persisted_score);
-            }
-            tokio::task::yield_now().await;
-        }
-    })
-    .await??;
-    assert_eq!(&persisted_score, score.as_ref());
+    assert!(
+        !test
+            .codex
+            .load_history(/*include_archived*/ false)
+            .await?
+            .items
+            .into_iter()
+            .any(|item| matches!(item, RolloutItem::SecurityRiskScore(_))),
+        "risk scores should not be persisted unless explicitly enabled"
+    );
     assert_eq!(
         registry
             .fast_approval_decision(
@@ -1867,7 +1857,7 @@ async fn contributor_persists_nested_code_mode_action_with_score() -> Result<()>
         Vec::new(),
         r#"{"path":"README.md"}"#,
         Some(TEST_GUARDIAN_POLICY),
-        "",
+        "[features.guardianv2]\nenabled = true\npersist_scores = true\n",
         /*model_defaults*/ None,
         ToolCallSource::CodeMode {
             cell_id: "cell-1".to_owned(),