Standardize shell execution on unified exec (#39757)

## What changed

- Remove the legacy `shell_command` handler and runtime, leaving `exec_command`
  and `write_stdin` as the shell execution tools.
- Treat legacy `shell_command` model metadata as `unified_exec`, and normalize
  legacy user opt-outs so they do not disable command execution. Managed feature
  requirements and `shell_tool` can still disable it.
- Preserve shell approvals, sandboxing, zsh-fork support, and output truncation
  through the unified execution path.

## Testing

- Cover legacy configuration and model-metadata compatibility.
- Exercise unified shell execution, approvals, truncation, and `apply_patch`
  serialization across the app-server and core test suites.

GitOrigin-RevId: 5c2fd6164fc3519cdae4944cb9db276b8467311c

codex-rs/ext/guardian-v2/src/async_scorer/extension.rs

@@ -56,7 +56,7 @@ fn should_classify_tool(
 ) -> bool {
     if sandboxed_exec_commands
         || !tool_name.is_default_namespace()
-        || !matches!(tool_name.name.as_str(), "exec_command" | "shell_command")
+        || tool_name.name != "exec_command"
     {
         return true;
     }

codex-rs/ext/guardian-v2/src/async_scorer/extension_tests.rs

@@ -271,25 +271,23 @@ async fn sandboxed_shell_classification_respects_review_scope() -> Result<()> {
         arguments: r#"{"cmd":"pwd","sandbox_permissions":"require_escalated"}"#.to_owned(),
     };
 
-    for tool_name in ["exec_command", "shell_command"] {
-        let tool_name = ToolName::plain(tool_name);
-        assert!(!should_classify_tool(
-            &tool_name, &sandboxed, /*sandboxed_exec_commands*/ false
-        ));
-        assert!(!should_classify_tool(
-            &tool_name,
-            &additional_permissions,
-            /*sandboxed_exec_commands*/ false
-        ));
-        assert!(should_classify_tool(
-            &tool_name,
-            &unsandboxed,
-            /*sandboxed_exec_commands*/ false
-        ));
-        assert!(should_classify_tool(
-            &tool_name, &sandboxed, /*sandboxed_exec_commands*/ true
-        ));
-    }
+    let tool_name = ToolName::plain("exec_command");
+    assert!(!should_classify_tool(
+        &tool_name, &sandboxed, /*sandboxed_exec_commands*/ false
+    ));
+    assert!(!should_classify_tool(
+        &tool_name,
+        &additional_permissions,
+        /*sandboxed_exec_commands*/ false
+    ));
+    assert!(should_classify_tool(
+        &tool_name,
+        &unsandboxed,
+        /*sandboxed_exec_commands*/ false
+    ));
+    assert!(should_classify_tool(
+        &tool_name, &sandboxed, /*sandboxed_exec_commands*/ true
+    ));
     assert!(should_classify_tool(
         &ToolName::plain("read_file"),
         &sandboxed,