chore(core) Deprecate approval_policy: on-failure (#11631)

## Summary
In an effort to start simplifying our sandbox setup, we're announcing
this approval_policy as deprecated. In general, it performs worse than
`on-request`, and we're focusing on making fewer sandbox configurations
perform much better.

## Testing
- [x] Tested locally
- [x] Existing tests pass

codex-rs/utils/cli/src/approval_mode_cli_arg.rs

@@ -12,9 +12,10 @@ pub enum ApprovalModeCliArg {
     /// is not in the "trusted" set.
     Untrusted,
 
-    /// Run all commands without asking for user approval.
+    /// DEPRECATED: Run all commands without asking for user approval.
     /// Only asks for approval if a command fails to execute, in which case it
     /// will escalate to the user to ask for un-sandboxed execution.
+    /// Prefer `on-request` for interactive runs or `never` for non-interactive runs.
     OnFailure,
 
     /// The model decides when to ask the user for approval.