Replace Guardian tickets with parent response IDs (#43002)

## What changed

Capture the ID from `response.created` and pass it as `parent_response_id` in Guardian review and classifier request metadata. Clear the current response ID before sampling retries so tool reviews cannot inherit a failed response's ID.

Request Guardian credits with `guardian_credits_requested` on eligible parent requests. Remove the ticket protocol, transport attachment, and ticket-specific body redaction. Keep ordinary app-server client `parent_response_id` values inside `x-codex-turn-metadata` rather than promoting them to Guardian request metadata.

## Testing

Update coverage for HTTP fallback, WebSocket review reuse, missing response IDs, classifier transport retries, and code-mode yield/resume attribution. Extend app-server tests to verify client metadata placement over HTTP and WebSocket.

GitOrigin-RevId: c1665e56382ecec8d260fc2ca0ecd5e20b0b2391

codex-rs/codex-api/src/sse/responses.rs

@@ -9,8 +9,6 @@ use crate::telemetry::SseTelemetry;
 use codex_client::ByteStream;
 use codex_client::StreamResponse;
 use codex_protocol::ResponseUsageMetadata;
-use codex_protocol::guardian_ticket::GUARDIAN_TICKET_HEADER;
-use codex_protocol::guardian_ticket::GuardianTicket;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::MisalignmentErrorDetails;
 use codex_protocol::protocol::ModelVerification;
@@ -409,17 +407,11 @@ pub fn process_responses_event(
         }
         "response.created" => {
             if let Some(response) = event.response {
-                let guardian_ticket = response
-                    .get("headers")
-                    .and_then(Value::as_object)
-                    .and_then(|headers| {
-                        headers
-                            .iter()
-                            .find(|(name, _)| name.eq_ignore_ascii_case(GUARDIAN_TICKET_HEADER))
-                    })
-                    .and_then(|(_, value)| value.as_str())
-                    .and_then(GuardianTicket::from_server);
-                return Ok(Some(ResponseEvent::Created { guardian_ticket }));
+                let response_id = response
+                    .get("id")
+                    .and_then(Value::as_str)
+                    .map(str::to_owned);
+                return Ok(Some(ResponseEvent::Created { response_id }));
             }
         }
         "response.failed" => {
@@ -1630,9 +1622,7 @@ mod tests {
         );
         assert_matches!(
             &events[1],
-            ResponseEvent::Created {
-                guardian_ticket: None
-            }
+            ResponseEvent::Created { response_id: Some(id) } if id == "resp-1"
         );
         assert_matches!(
             &events[2],