Persist security risk scores in rollout history (#38363)

## What changed

- Add a `SecurityRiskScore` rollout item containing a category and numeric score.
- Persist the item in both thread history modes while excluding it from model context, user-visible thread history, search text, forks, and reconstructed conversation history.
- Re-export the score type from the extension API.

## Testing

- Cover serialization, persistence and loading, thread history projection, session reconstruction, append planning, and memory filtering.

GitOrigin-RevId: 1926fe366aeaa75052708a6da589f45a38eefb52

codex-rs/thread-store/src/local/rollout_migration/canonicalizer.rs

@@ -292,6 +292,7 @@ impl LegacyRolloutCanonicalizer {
             }
             item @ (RolloutItem::InterAgentCommunicationMetadata { .. }
             | RolloutItem::TurnContext(_)
+            | RolloutItem::SecurityRiskScore(_)
             | RolloutItem::WorldState(_)) => {
                 self.write_item(writer, &timestamp, item).await?;
             }

codex-rs/thread-store/src/local/rollout_migration/rollback_plan.rs

@@ -220,6 +220,7 @@ impl RollbackPlanner {
                 }
             }
             RolloutItem::WorldState(_) => {}
+            RolloutItem::SecurityRiskScore(_) => self.record_boundaries[index] = None,
         }
 
         Ok(())

codex-rs/thread-store/src/local/rollout_migration/rollback_replay.rs

@@ -75,6 +75,7 @@ impl ModelReplayPlanner {
             | RolloutItem::ResponseItem(_)
             | RolloutItem::EventMsg(_)
             | RolloutItem::InterAgentCommunicationMetadata { .. }
+            | RolloutItem::SecurityRiskScore(_)
             | RolloutItem::WorldState(_) => return,
         };
         self.records.push(record);