Handle pending network reviews after process completion (#42746)

## Why

A remote process can finish while a network policy review is still pending. Normal process cleanup should withdraw that review without turning the completed command into a review failure or losing its output.

## What changed

- Record whether a network policy request was withdrawn because the process finished, was cancelled, lost its executor connection, or timed out.
- Treat normal process completion as cleanup while retaining fail-closed behavior for other cancellation causes.
- Preserve explicit network denials before policy persistence so cleanup cannot replace the reported call outcome.

## Testing

Add an integration test that completes a remote process during a pending network review and verifies that the command reports its successful exit and output without approving the withdrawn request.

GitOrigin-RevId: 7f42d75631ee29eba43bf04cc953eea490f553fc

codex-rs/core/src/session/tests/guardian_tests.rs

@@ -786,6 +786,7 @@ async fn network_approval_uses_published_task_authority_within_same_turn(
                 exec_policy_hint: None,
                 execution_id: None,
                 disconnect: None,
+                cancellation: None,
             },
         );
     tokio::pin!(decision);