Preserve root user authorization in subagent Guardian reviews (#39975)

## Why

MultiAgent V2 workers can be reviewed after the root conversation has received
new user authorization that is absent from the worker's own transcript. Guardian
reviews need that genuine user context without treating forwarded or
assistant-authored claims as authorization.

## What changed

- Add the bounded root conversation to Guardian prompts for worker reviews.
- Preserve user and assistant roles, and explicitly treat only root user messages
  as authorization evidence.
- Exclude summaries, review artifacts, and assistant commentary from the root
  conversation evidence.
- Apply the same evidence to both core Guardian prompts and Guardian V2
  classification.

## Testing

Add an integration test covering late root-user authorization, forged role text,
forwarded agent claims, and filtered synthetic authorization.

GitOrigin-RevId: 8846de69ba214a88f58f70675798d324e213427c

codex-rs/core/src/lib.rs

@@ -42,6 +42,7 @@ pub use codex_protocol::protocol::EnvironmentConfig;
 pub use codex_thread::BackgroundTerminalInfo;
 pub use codex_thread::CodexThread;
 pub use codex_thread::CodexThreadSettingsOverrides;
+pub use codex_thread::GuardianRootMessage;
 pub use codex_thread::ThreadConfigSnapshot;
 pub use session::turn_context::TurnContext;
 mod agent;