Add Guardian v2 approval review metrics (#39224)

## What changed

- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.

## Testing

- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.

GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a

codex-rs/ext/extension-api/src/registry.rs

@@ -7,6 +7,7 @@ use crate::ConfigContributor;
 use crate::ContextContributor;
 use crate::ExtensionData;
 use crate::ExtensionEventSink;
+use crate::ExtensionMetrics;
 use crate::McpServerContributor;
 use crate::NoopExtensionEventSink;
 use crate::SkillInvocationContributor;
@@ -194,10 +195,16 @@ impl<C: Sync> ExtensionRegistry<C> {
         session_store: &ExtensionData,
         thread_store: &ExtensionData,
         prompt: &str,
+        extension_metrics: Option<Arc<dyn ExtensionMetrics>>,
     ) -> Option<ReviewDecision> {
         for contributor in &self.approval_review_contributors {
             if let Some(decision) = contributor
-                .contribute(session_store, thread_store, prompt)
+                .contribute(
+                    session_store,
+                    thread_store,
+                    prompt,
+                    extension_metrics.clone(),
+                )
                 .await
             {
                 return Some(decision);