Preserve plugin attribution across command approvals (#35029)

## What changed

- Add optional `plugin_id` and `script_path` fields to execution approval and guardian assessment events.
- Propagate validated plugin attribution through delegated approvals, guardian-reviewed command items, app-server notifications, thread history, and rollout traces.
- Preserve attribution on both started and completed command items, including declined commands.

## Testing

- Extend core, app-server, thread-history, and rollout-trace tests to cover plugin attribution propagation and serialization.

GitOrigin-RevId: 723684d010cab04142918d7a95e06ed95d008da1

codex-rs/rollout-trace/src/protocol_event_tests.rs

@@ -56,8 +56,8 @@ fn exec_command_trace_payloads_use_inferred_native_cwd() -> anyhow::Result<()> {
     // Windows and POSIX paths on every platform.
     let begin = EventMsg::ExecCommandBegin(ExecCommandBeginEvent {
         call_id: "call-begin".to_string(),
-        plugin_id: None,
-        script_path: None,
+        plugin_id: Some("sample@openai-curated".to_string()),
+        script_path: Some("scripts/run.py".to_string()),
         process_id: Some("process-1".to_string()),
         turn_id: "turn-1".to_string(),
         started_at_ms: 1234,
@@ -69,8 +69,8 @@ fn exec_command_trace_payloads_use_inferred_native_cwd() -> anyhow::Result<()> {
     });
     let end = EventMsg::ExecCommandEnd(ExecCommandEndEvent {
         call_id: "call-end".to_string(),
-        plugin_id: None,
-        script_path: None,
+        plugin_id: Some("sample@openai-curated".to_string()),
+        script_path: Some("scripts/run.py".to_string()),
         process_id: None,
         turn_id: "turn-1".to_string(),
         completed_at_ms: 2345,
@@ -96,6 +96,8 @@ fn exec_command_trace_payloads_use_inferred_native_cwd() -> anyhow::Result<()> {
         serde_json::to_value(payload)?,
         json!({
             "call_id": "call-begin",
+            "plugin_id": "sample@openai-curated",
+            "script_path": "scripts/run.py",
             "process_id": "process-1",
             "turn_id": "turn-1",
             "started_at_ms": 1234,
@@ -113,6 +115,8 @@ fn exec_command_trace_payloads_use_inferred_native_cwd() -> anyhow::Result<()> {
         serde_json::to_value(payload)?,
         json!({
             "call_id": "call-end",
+            "plugin_id": "sample@openai-curated",
+            "script_path": "scripts/run.py",
             "turn_id": "turn-1",
             "completed_at_ms": 2345,
             "command": ["pwd"],