Merge branch 'rhan/approval-source' into rhan/escalations-approvals-sandbox

# Conflicts:
#	codex-rs/core/src/codex.rs
#	codex-rs/core/src/codex_tests.rs
#	codex-rs/core/src/state/turn.rs

codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json

@@ -1,6 +1,15 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
+    "ApprovalSourceMetadata": {
+      "enum": [
+        "guardian",
+        "user",
+        "policy",
+        "unknown"
+      ],
+      "type": "string"
+    },
     "ContentItem": {
       "oneOf": [
         {
@@ -872,6 +881,16 @@
     },
     "ResponseItemMetadata": {
       "properties": {
+        "approval_source": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ApprovalSourceMetadata"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "is_tool_call_escalated": {
           "type": [
             "boolean",