Retire the untrusted approval policy (#39630)

## What changed

- Remove `untrusted` from the CLI, configuration schema, and MCP tool interface. Explicit `approval_policy = "untrusted"` settings now fail with an actionable error.
- Remove the known-safe command allowlist. Projects marked untrusted now request approval for every command unless an explicit exec policy rule allows it.
- Keep command parsing conservative by treating in-place `sed` forms as mutating and ignoring unrecognized commands when recording memory usage.

## Testing

- Cover rejection of the retired configuration value and approval requests for commands in untrusted projects.

GitOrigin-RevId: d6bf425edddfffbb325eee6acf383434af5fd33b

codex-rs/mcp-server/src/codex_tool_config.rs

@@ -36,7 +36,7 @@ pub struct CodexToolCallParam {
     pub cwd: Option<String>,
 
     /// Approval policy for shell commands generated by the model:
-    /// `untrusted`, `on-request`, `never`.
+    /// `on-request`, `never`.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub approval_policy: Option<CodexToolCallApprovalPolicy>,
 
@@ -67,7 +67,6 @@ pub struct CodexToolCallParam {
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema, PartialEq)]
 #[serde(rename_all = "kebab-case")]
 pub enum CodexToolCallApprovalPolicy {
-    Untrusted,
     OnRequest,
     Never,
 }
@@ -75,7 +74,6 @@ pub enum CodexToolCallApprovalPolicy {
 impl From<CodexToolCallApprovalPolicy> for AskForApproval {
     fn from(value: CodexToolCallApprovalPolicy) -> Self {
         match value {
-            CodexToolCallApprovalPolicy::Untrusted => AskForApproval::UnlessTrusted,
             CodexToolCallApprovalPolicy::OnRequest => AskForApproval::OnRequest,
             CodexToolCallApprovalPolicy::Never => AskForApproval::Never,
         }
@@ -299,9 +297,8 @@ mod tests {
             "additionalProperties": false,
             "properties": {
               "approval-policy": {
-                "description": "Approval policy for shell commands generated by the model: `untrusted`, `on-request`, `never`.",
+                "description": "Approval policy for shell commands generated by the model: `on-request`, `never`.",
                 "enum": [
-                  "untrusted",
                   "on-request",
                   "never"
                 ],