chore: add a separate reject-policy flag for skill approvals (#14271)

## Summary
- add `skill_approval` to `RejectConfig` and the app-server v2
`AskForApproval::Reject` payload so skill-script prompts can be
configured independently from sandbox and rule-based prompts
- update Unix shell escalation to reject prompts based on the actual
decision source, keeping prefix rules tied to `rules`, unmatched command
fallbacks tied to `sandbox_approval`, and skill scripts tied to
`skill_approval`
- regenerate the affected protocol/config schemas and expand
unit/integration coverage for the new flag and skill approval behavior

codex-rs/core/src/codex_tests.rs

@@ -2308,6 +2308,7 @@ async fn request_permissions_emits_event_when_reject_policy_allows_requests() {
             crate::protocol::RejectConfig {
                 sandbox_approval: true,
                 rules: true,
+                skill_approval: false,
                 request_permissions: false,
                 mcp_elicitations: true,
             },
@@ -2382,6 +2383,7 @@ async fn request_permissions_returns_empty_grant_when_reject_policy_blocks_reque
             crate::protocol::RejectConfig {
                 sandbox_approval: false,
                 rules: false,
+                skill_approval: false,
                 request_permissions: true,
                 mcp_elicitations: false,
             },