Add Guardian v2 approval review metrics (#39224)

## What changed

- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.

## Testing

- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.

GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a

codex-rs/ext/extension-api/tests/registry.rs

@@ -135,6 +135,7 @@ impl ApprovalReviewContributor for AllContributors {
         _session_store: &'a ExtensionData,
         _thread_store: &'a ExtensionData,
         _prompt: &'a str,
+        _extension_metrics: Option<Arc<dyn ExtensionMetrics>>,
     ) -> ExtensionFuture<'a, Option<ReviewDecision>> {
         Box::pin(async move {
             let _self = self;
@@ -176,6 +177,7 @@ async fn build_round_trips_every_contributor_category() {
                 &ExtensionData::new("session"),
                 &ExtensionData::new("thread"),
                 "review this",
+                /*extension_metrics*/ None,
             )
             .await,
         Some(ReviewDecision::ApprovedForSession)
@@ -322,6 +324,7 @@ impl ApprovalReviewContributor for RecordingApprovalContributor {
         session_store: &'a ExtensionData,
         thread_store: &'a ExtensionData,
         prompt: &'a str,
+        _extension_metrics: Option<Arc<dyn ExtensionMetrics>>,
     ) -> ExtensionFuture<'a, Option<ReviewDecision>> {
         Box::pin(async move {
             self.calls
@@ -363,6 +366,7 @@ async fn approval_review_returns_first_claim_and_short_circuits() {
             &ExtensionData::new("session-1"),
             &ExtensionData::new("thread-1"),
             "allow command?",
+            /*extension_metrics*/ None,
         )
         .await;
 
@@ -451,6 +455,7 @@ async fn empty_registry_does_not_claim_approval_review() {
                 &ExtensionData::new("session"),
                 &ExtensionData::new("thread"),
                 "unclaimed",
+                /*extension_metrics*/ None,
             )
             .await,
         None