Add safer TUI defaults for cyber models (#37055)

## What changed

- Propagate the optional `modelSpecialty` field through the model catalog and
  app-server `model/list` response.
- When a newly selected model has the `cyber` specialty, default an active TUI
  thread to workspace-write permissions with on-request approval. Use auto
  review when available, otherwise keep the user as reviewer, while respecting
  configured permission requirements.
- Show a notice when auto review is applied and strengthen the full-access
  warning for cyber models.
- Preserve explicitly selected permissions when only reasoning settings change.

## Testing

- Cover auto-review defaults, requirement-aware fallback behavior, permission
  preservation across reasoning changes, and the new warning notice.

GitOrigin-RevId: 8f25b0082d3051d9ff91f7355921236d0f82f758

codex-rs/tui/src/app_server_session.rs

@@ -1025,9 +1025,9 @@ impl AppServerSession {
     pub(crate) async fn thread_settings_update(
         &mut self,
         params: ThreadSettingsUpdateParams,
-    ) -> Result<()> {
+    ) -> Result<bool> {
         if !self.thread_settings_update_supported {
-            return Ok(());
+            return Ok(false);
         }
         let request_id = self.next_request_id();
         match self
@@ -1038,7 +1038,7 @@ impl AppServerSession {
             })
             .await
         {
-            Ok(_) => Ok(()),
+            Ok(_) => Ok(true),
             Err(TypedRequestError::Server { source, .. })
                 if is_thread_settings_update_unsupported(&source) =>
             {
@@ -1049,7 +1049,7 @@ impl AppServerSession {
                 // of showing an error every time the user changes model, effort,
                 // personality, or mode.
                 self.thread_settings_update_supported = false;
-                Ok(())
+                Ok(false)
             }
             Err(err) => Err(err).wrap_err("thread/settings/update failed in TUI"),
         }
@@ -1526,6 +1526,7 @@ fn model_preset_from_api_model(model: ApiModel) -> ModelPreset {
         model: model.model,
         display_name: model.display_name,
         description: model.description,
+        model_specialty: model.model_specialty,
         default_reasoning_effort: model.default_reasoning_effort,
         supported_reasoning_efforts: model
             .supported_reasoning_efforts