Interrupt cyber model turns after one Guardian denial (#37190)

## What changed

- Add a Guardian circuit-breaker policy for models whose catalog specialty is
  `cyber`.
- Interrupt those models after the first Guardian denial while retaining the
  existing denial thresholds for other models.
- Centralize the `cyber` model-specialty identifier for use across core,
  protocol, app-server, and TUI code.

## Testing

- Cover the cyber-specific threshold in the circuit-breaker unit tests.
- Verify end to end that a denied command is not executed and the turn is
  interrupted after one denial.

GitOrigin-RevId: fad24c9e7aa280432580db1f0e39d13535779710

codex-rs/tui/src/chatwidget/permission_popups.rs

@@ -5,6 +5,7 @@
 //! `windows_sandbox_prompts`.
 
 use super::*;
+use codex_protocol::openai_models::MODEL_SPECIALTY_CYBER;
 
 impl ChatWidget {
     /// Open the permissions popup.
@@ -410,7 +411,7 @@ impl ChatWidget {
         let is_cyber_model = self.model_catalog.try_list_models().is_ok_and(|models| {
             models.iter().any(|model| {
                 model.model == self.current_model()
-                    && model.model_specialty.as_deref() == Some("cyber")
+                    && model.model_specialty.as_deref() == Some(MODEL_SPECIALTY_CYBER)
             })
         });
         let title_line = Line::from("Enable full access?").bold();