chore(core) Deprecate approval_policy: on-failure (#11631)

## Summary
In an effort to start simplifying our sandbox setup, we're announcing
this approval_policy as deprecated. In general, it performs worse than
`on-request`, and we're focusing on making fewer sandbox configurations
perform much better.

## Testing
- [x] Tested locally
- [x] Existing tests pass

codex-rs/debug-client/README.md

@@ -26,7 +26,7 @@ cargo run -p codex-debug-client -- --thread-id thr_123
 - `--codex-bin <path>`: path to the `codex` binary (default: `codex`).
 - `-c, --config key=value`: pass through `--config` overrides to `codex`.
 - `--thread-id <id>`: resume a thread instead of starting a new one.
-- `--approval-policy <policy>`: `untrusted`, `on-failure`, `on-request`, `never`.
+- `--approval-policy <policy>`: `untrusted`, `on-failure` (deprecated), `on-request`, `never`.
 - `--auto-approve`: auto-approve command/file-change approvals (default: decline).
 - `--final-only`: only show completed assistant messages and tool items.
 - `--model <name>`: optional model override for thread start/resume.