Read approval policy from the current turn configuration (#36912)

## Why

Thread settings can update the approval policy after a turn context is created.
Keeping a separate copy on `TurnContext` could leave tool approval checks using
the previous policy.

## What changed

- Remove the duplicated approval-policy field from `TurnContext`.
- Resolve the policy through the turn's current configuration everywhere it is
  needed, including tool execution, Guardian routing, MCP handling, and
  permission requests.

## Testing

- Update the shell escalation test to apply a thread-level policy override and
  verify that the next turn rejects an escalation using the updated policy.

GitOrigin-RevId: e5966ba08f179d53fd76871ad904762958c0f5ea

codex-rs/core/src/codex_delegate_tests.rs

@@ -430,7 +430,8 @@ async fn handle_exec_approval_uses_call_id_for_guardian_review_and_approval_id_f
     let mut config = (*parent_ctx.config).clone();
     config.approvals_reviewer = ApprovalsReviewer::AutoReview;
     parent_ctx.config = Arc::new(config);
-    parent_ctx
+    Arc::make_mut(&mut parent_ctx.config)
+        .permissions
         .approval_policy
         .set(AskForApproval::OnRequest)
         .expect("set on-request policy");
@@ -553,7 +554,8 @@ async fn delegated_mcp_guardian_abort_returns_synthetic_decline_answer() {
     let mut config = (*parent_ctx.config).clone();
     config.approvals_reviewer = ApprovalsReviewer::AutoReview;
     parent_ctx.config = Arc::new(config);
-    parent_ctx
+    Arc::make_mut(&mut parent_ctx.config)
+        .permissions
         .approval_policy
         .set(AskForApproval::OnRequest)
         .expect("set on-request policy");