[codex] Treat Guardian capacity exhaustion as unavailable

[kbazzi]

Problem

Guardian review can fail before it produces a policy assessment. One concrete case is repeated selected-model-capacity / server_is_overloaded responses from the Guardian reviewer model.

#27062 made structured transient Guardian session failures retryable, but after the retry budget was exhausted the terminal error still flowed through the generic fail-closed path. That path synthesizes a high-risk denial, so model capacity exhaustion could be reported as an Auto Review denial instead of Guardian unavailability.

That distinction matters for the timeout/manual-fallback behavior in #27440: exhausted transient infrastructure failures should be treated as unavailable or timed out, not as Guardian denying the action.

What Changed

• Reuse the structured transient Guardian session error classifier for both retry eligibility and terminal handling.
• When retries exhaust on a structured transient session error, emit a timed-out Guardian assessment and return ReviewDecision::TimedOut.
• Preserve the original capacity error text in the warning for diagnosis.
• Keep deterministic or unstructured Guardian failures on the existing fail-closed denial path.
• Add regression coverage for repeated selected-model-capacity failures, including the opt-in manual approval fallback from [codex] Fall back to manual approval when Guardian times out #27440.

Stack

Stacked on #27440. This PR is only about exhausted transient Guardian session failures such as model capacity. #27440 owns the opt-in guardian_manual_approval_fallback feature flag, and #27537 is stacked above this PR for the separate remote-compact websocket reset classification issue.

Validation

• just test -p codex-core guardian_review_exhausted_model_capacity_failures_do_not_deny --no-capture
• env -u CODEX_SANDBOX -u CODEX_SANDBOX_NETWORK_DISABLED just test -p codex-core guardian_capacity_exhaustion_falls_back_to_manual_approval_end_to_end --no-capture
• just fix -p codex-core

[github-actions]

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.