Enforce non-interactive approval policy for Codex delegates (#38205)

## What changed

- Require delegated Codex sessions to use the `never` approval policy and reject
  delegate creation with any prompt-capable policy.
- Stop forwarding delegate approval and permission requests to the parent
  session. Approval-requiring commands and MCP tool calls are denied within the
  delegate instead.
- Skip prompts for missing skill MCP dependencies when approvals are disabled.

## Testing

Add coverage for review and Guardian delegates to verify that command
escalations, MCP approvals, and skill dependency installation do not prompt or
execute approval-gated actions.

GitOrigin-RevId: fee96a97624352cd25c904592ba7eebe2ae3fd63

codex-rs/core/src/session/mod.rs

@@ -2667,40 +2667,6 @@ impl Session {
         }
     }
 
-    pub(crate) async fn request_permissions_for_cwd(
-        self: &Arc<Self>,
-        turn_context: &Arc<TurnContext>,
-        call_id: String,
-        args: RequestPermissionsArgs,
-        cwd: AbsolutePathBuf,
-        cancellation_token: CancellationToken,
-    ) -> Option<RequestPermissionsResponse> {
-        let turn_environment = match args.environment_id.as_deref() {
-            Some(environment_id) => turn_context
-                .environments
-                .turn_environments()
-                .find(|environment| environment.environment_id == environment_id),
-            None => turn_context.environments.primary(),
-        };
-        let Some(turn_environment) = turn_environment else {
-            return Some(RequestPermissionsResponse {
-                permissions: RequestPermissionProfile::default(),
-                scope: PermissionGrantScope::Turn,
-                strict_auto_review: false,
-            });
-        };
-        let mut environment = turn_environment.selection();
-        environment.cwd = PathUri::from_abs_path(&cwd);
-        self.request_permissions_for_environment(
-            turn_context,
-            call_id,
-            args,
-            environment,
-            cancellation_token,
-        )
-        .await
-    }
-
     #[expect(
         clippy::await_holding_invalid_type,
         reason = "active turn checks and turn state updates must remain atomic"