Merge remote-tracking branch 'origin/rhan/escalations-approvals-sandbox' into rhan/approval-source1

# Conflicts:
#	codex-rs/app-server-protocol/schema/typescript/ResponseItemMetadata.ts
#	codex-rs/core/src/codex_tests.rs
#	codex-rs/protocol/src/models.rs

codex-rs/app-server-protocol/schema/json/ClientRequest.json

@@ -2005,16 +2005,6 @@
           "description": "Client-visible metadata ID generated by Codex for this item.",
           "type": "string"
         },
-        "sandbox_policy": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/SandboxPolicyMetadata"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
         "user_message_type": {
           "anyOf": [
             {
@@ -2059,16 +2049,6 @@
             }
           ]
         },
-        "sandbox_policy": {
-          "anyOf": [
-            {
-              "$ref": "#/definitions/SandboxPolicyMetadata"
-            },
-            {
-              "type": "null"
-            }
-          ]
-        },
         "user_message_type": {
           "anyOf": [
             {
@@ -2454,14 +2434,6 @@
         }
       ]
     },
-    "SandboxPolicyMetadata": {
-      "enum": [
-        "read_only",
-        "sandbox",
-        "full_access"
-      ],
-      "type": "string"
-    },
     "ServiceTier": {
       "enum": [
         "fast",