Decouple session isolation from subagent attribution (#44521)

## Why

Session isolation relied on Guardian source attribution. An explicit policy lets callers control inherited capabilities independently of how a session is attributed.

## What changed

- Add `SessionIsolation` with default `Inherit` and opt-in `Isolated` modes, captured at session startup through `ExtensionDataInit`.
- Use the policy to control inherited instructions, extensions, execution rules, and MCP resources. Isolated sessions retain managed execution rules and omit executor-discovered MCP servers.
- Explicitly isolate Guardian reviewers while preserving source-based fallback for older callers and saved reviewers.

## Testing

Extend delegate tests to cover isolation independently of attribution, update execution-policy coverage to supply the explicit policy, and assert that managed reviewers do not inherit the parent's configured MCP tools.

GitOrigin-RevId: f0ab42fa2f0237860ec661e72693ab191216afbf

codex-rs/app-server/tests/suite/v2/guardian_sync_session_tests.rs

@@ -124,6 +124,12 @@ async fn managed_reviewers_reuse_fork_and_resume_after_parent_shutdown(
     // The seed review finished; pause the parent before it requests concurrent approvals.
     timeout(TIMEOUT, server.wait_for_request_count(/*count*/ 3)).await?;
     let seed: Value = serde_json::from_slice(&server.requests().await[1])?;
+    assert!(
+        !seed["tools"]
+            .to_string()
+            .contains(&format!("mcp__{TEST_SERVER_NAME}")),
+        "reviewers must not inherit the parent's configured MCP tools"
+    );
     let reviewer_id = seed["client_metadata"]["thread_id"]
         .as_str()
         .expect("reviewer ID")