Bypass review for always-allow MCP tools in auto-review (#20069)

## Why

When an MCP or app tool is configured with approval mode `approve`
(always allow), users expect that decision to be authoritative. In
guardian auto-review mode, ARC could still return `ask-user`, which then
routed the approval question into guardian with the ARC reason as
context. That meant a tool explicitly configured as always allowed still
went through both safety monitors before running.

This change keeps the existing ARC behavior for non-auto-review
sessions, but avoids the ARC-to-guardian sequence when
`approvals_reviewer = auto_review` and the tool approval mode is
`approve`.

## What changed

- Short-circuit MCP tool approval handling when `approval_mode ==
approve` and `approvals_reviewer == auto_review`.
- Updated the MCP approval regression test so the auto-review case
asserts neither ARC nor guardian is called.
- Preserved existing tests that verify ARC can still block always-allow
MCP tools outside guardian auto-review mode.

## Verification

- `cargo test -p codex-core --lib mcp_tool_call`

codex-rs/codex-mcp/src/elicitation.rs

@@ -9,6 +9,7 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::sync::Mutex as StdMutex;
 
+use crate::mcp::McpPermissionPromptAutoApproveContext;
 use crate::mcp::mcp_permission_prompt_is_auto_approved;
 use anyhow::Context;
 use anyhow::Result;
@@ -87,8 +88,11 @@ impl ElicitationRequestManager {
                     .lock()
                     .map(|profile| profile.clone())
                     .unwrap_or_default();
-                if mcp_permission_prompt_is_auto_approved(approval_policy, &permission_profile)
-                    && can_auto_accept_elicitation(&elicitation)
+                if mcp_permission_prompt_is_auto_approved(
+                    approval_policy,
+                    &permission_profile,
+                    McpPermissionPromptAutoApproveContext::default(),
+                ) && can_auto_accept_elicitation(&elicitation)
                 {
                     return Ok(ElicitationResponse {
                         action: ElicitationAction::Accept,