[codex] Validate approval responses against pending authority

[bookholt-oai]

Why

Approval responses were matched only by a string ID, so an exec response could consume a patch waiter with the same ID. The server also accepted persistence payloads that it had not offered. This made the approval boundary depend too heavily on client-supplied response data.

This is the generic approval-integrity layer in the PSEC-4922 stack. It is based on draft #30628's parser-provenance work; later layers compose the runtime PowerShell policy. It does not close PSEC-4922 by itself.

What

• Track pending approvals by request kind and ID.
• Record the exact decisions and amendment payloads accepted for each request.
• Reject duplicate pending IDs without replacing the original waiter or emitting another prompt.
• Consume each waiter once before applying an amendment or resuming execution.
• Route delegated cancellation to the matching exec or patch waiter while keeping Guardian-only reviews independent.
• Preserve ordinary session approval and the existing exact server-proposed restrictive network-deny path.

How

Pending approval entries now carry their request kind, one-shot sender, and accepted decisions. Occupied entries retain the original waiter and fail the duplicate request closed. Exec and patch handlers take only a matching entry, convert unoffered responses to denial, and then apply any accepted amendment or deliver the result. Tests cover kind isolation, duplicate IDs, exact payload validation, replay, cancellation, delegation, telemetry, and compatibility behavior.

Testing

• just test -p codex-protocol (241 passed)
• just test -p codex-core pending_approval
• just test -p codex-core duplicate_same_kind_pending_approval
• just test -p codex-core duplicate_same_kind_approval_request
• just test -p codex-core approval (147 passed outside the outer sandbox; after the base refresh, 141 passed locally and six sandbox-dependent cases could not write proxy state or start nested Seatbelt)
• Focused cross-kind routing, delegated cancellation, and session-approval tests
• Full codex-core was attempted locally; stage-owned tests passed, while unrelated sandbox/fixture-dependent tests could not run successfully in the outer sandbox
• Required CI: pending before this draft is marked ready

Related: PSEC-4922