Persist security risk scores in rollout history (#38363)

## What changed

- Add a `SecurityRiskScore` rollout item containing a category and numeric score.
- Persist the item in both thread history modes while excluding it from model context, user-visible thread history, search text, forks, and reconstructed conversation history.
- Re-export the score type from the extension API.

## Testing

- Cover serialization, persistence and loading, thread history projection, session reconstruction, append planning, and memory filtering.

GitOrigin-RevId: 1926fe366aeaa75052708a6da589f45a38eefb52

codex-rs/app-server-protocol/src/protocol/thread_history.rs

@@ -405,6 +405,7 @@ impl ThreadHistoryBuilder {
             | RolloutItem::InterAgentCommunicationMetadata { .. }
             | RolloutItem::TurnContext(_)
             | RolloutItem::WorldState(_)
+            | RolloutItem::SecurityRiskScore(_)
             | RolloutItem::SessionMeta(_) => {}
         }
     }

codex-rs/app-server-protocol/src/protocol/thread_history_projection.rs

@@ -82,6 +82,7 @@ pub fn project_rollout_line(line: &RolloutLine) -> ThreadHistoryChangeSet {
         | RolloutItem::Compacted(_)
         | RolloutItem::TurnContext(_)
         | RolloutItem::WorldState(_)
+        | RolloutItem::SecurityRiskScore(_)
         | RolloutItem::EventMsg(_) => ThreadHistoryChangeSet::default(),
     }
 }

codex-rs/app-server-protocol/src/protocol/thread_history_projection_tests.rs

@@ -10,6 +10,7 @@ use codex_protocol::protocol::TurnAbortReason;
 use codex_protocol::protocol::TurnAbortedEvent;
 use codex_protocol::protocol::TurnCompleteEvent;
 use codex_protocol::protocol::TurnStartedEvent;
+use codex_protocol::security_risk::SecurityRiskScore;
 use codex_protocol::user_input::UserInput;
 use codex_rollout::CompactedItem;
 use codex_rollout::RolloutItem;
@@ -200,9 +201,14 @@ fn ignores_legacy_abort_without_turn_id_and_context_only_records() {
         previous_window_id: None,
         window_id: None,
     }));
+    let security_risk = project(RolloutItem::SecurityRiskScore(SecurityRiskScore {
+        category: "action_risk".to_string(),
+        score: 0.92,
+    }));
 
     assert!(aborted.is_empty());
     assert!(compacted.is_empty());
+    assert!(security_risk.is_empty());
 }
 
 #[test]