fix(agent): pin codex approvals_reviewer to host

[rnegron]

Problem

Codex runs on posthog_code fail every command with:

403 Forbidden — Model 'codex-auto-review' not allowed for product 'posthog_code'

Codex 0.140.0 — the native openai/codex app-server harness PostHog Code switched to (replacing the old codex-acp adapter) — ships its guardian approval reviewer as a stable, default-on feature. The reviewer calls a dedicated codex-auto-review model, which our gateway's posthog_code allowlist does not serve, so it is rejected 403 at the access check. The host already owns approvals (approvals.ts → requestPermission), so the guardian is a redundant second authority.

Changes

• Pin codex's approvals_reviewer to its own default "user" in buildAppServerArgs, keeping approval decisions on the host instead of the gateway-blocked codex-auto-review model.
• "auto_review" and the legacy "guardian_subagent" are the same variant — both hit codex-auto-review, so "user" is the only value that keeps traffic on allowlisted models.

How did you test this?

• vitest run src/adapters/codex-app-server — 160 pass (2 unrelated failures: unbuilt @posthog/git workspace dep). New assertion in spawn.test.ts locks the flag.
• Real codex 0.140.0 binary: -c approvals_reviewer="user" → exit 0; -c approvals_reviewer="bogus" → unknown variant 'bogus', expected one of 'user', 'auto_review', 'guardian_subagent' — confirms it is a first-class, validated config value.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

React Doctor found no issues in the changed files. 🎉

_{Reviewed by React Doctor for commit 6411648.}

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(agent): pin codex approvals_reviewer..." | Re-trigger Greptile}

[github-actions]

No showstoppers. The fix correctly pins the Codex approvals reviewer to prevent gateway 403s, with a test verifying the new arg. The bot comment about configOverrides shadowing is resolved and the code explicitly documents the intentional override escape hatch.