fix(agent): pin codex approvals_reviewer to host

[rnegron]

Problem

Codex runs on posthog_code fail every command with:

403 Forbidden — Model 'codex-auto-review' not allowed for product 'posthog_code'

Codex 0.140.0 — the native openai/codex app-server harness PostHog Code switched to (replacing the old codex-acp adapter) — ships its guardian approval reviewer as a stable, default-on feature. The reviewer calls a dedicated codex-auto-review model, which our gateway's posthog_code allowlist does not serve, so it is rejected 403 at the access check. The host already owns approvals (approvals.ts → requestPermission), so the guardian is a redundant second authority.

Changes

• Pin codex's approvals_reviewer to its own default "user" in buildAppServerArgs, keeping approval decisions on the host instead of the gateway-blocked codex-auto-review model.
• "auto_review" and the legacy "guardian_subagent" are the same variant — both hit codex-auto-review, so "user" is the only value that keeps traffic on allowlisted models.

How did you test this?

• vitest run src/adapters/codex-app-server — 160 pass (2 unrelated failures: unbuilt @posthog/git workspace dep). New assertion in spawn.test.ts locks the flag.
• Real codex 0.140.0 binary: -c approvals_reviewer="user" → exit 0; -c approvals_reviewer="bogus" → unknown variant 'bogus', expected one of 'user', 'auto_review', 'guardian_subagent' — confirms it is a first-class, validated config value.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

😎 Merged successfully - details.

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 6411648.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(agent): pin codex approvals_reviewer..." | Re-trigger Greptile}

[github-actions]

No showstoppers. The fix correctly pins the Codex approvals reviewer to prevent gateway 403s, with a test verifying the new arg. The bot comment about configOverrides shadowing is resolved and the code explicitly documents the intentional override escape hatch.