fix(codex): use supported safe-yolo approval policy

[NPUlrk]

Summary

• replace Codex safe-yolo's removed on-failure approval policy with on-request
• keep the existing workspace-write sandbox and HAPI auto-approval behavior
• update local launcher and app-server regression tests

Problem

Codex CLI 0.144.x no longer accepts on-failure. Starting or resuming a HAPI Codex session in safe-yolo mode sends that value to thread/start or thread/resume, which fails immediately with:

Invalid request: unknown variant `on-failure`, expected one of `untrusted`, `on-request`, `granular`, `never`

For resumed sessions, the user-facing result is:

Task failed: Codex conversation <id> could not be resumed; no new conversation was created

on-request preserves sandbox escalation support, while HAPI's existing CodexPermissionHandler continues to auto-approve requests in safe-yolo mode.

Testing

• bun typecheck
• bun run test (CLI, hub, web, and shared suites)

AI disclosure

This focused fix and its tests were prepared with OpenAI Codex assistance and manually verified against Codex CLI 0.144.x behavior.

[github-actions]

Findings
No issues found in the added/modified lines.

Summary
Review mode: initial
No diff-anchored blocker/major/minor findings. Residual risk: remote resume does not have a direct launcher-level assertion for safe-yolo approval params, but the shared thread-param helper now has start/resume-relevant coverage and the local launcher assertion was updated.

Testing
Not run (automation)

HAPI Bot