Attach network approval reviews to parent tool items

[charley-oai]

Summary

• carry an optional parent tool item id on GuardianApprovalRequest::NetworkAccess
• use that parent id when app-server populates guardian review targetItemId for attributed network_access reviews
• keep the existing fallback to the guardian review id when no parent tool item can be determined
• add focused tests and update the app-server README

Testing

• just fmt
• started focused cargo test -p codex-core guardian_request_turn_id_prefers_network_access_owner_turn verification on a cold cache; stopped before completion while opening this PR

[charley-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 🎉

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[charley-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b565d13a2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[charley-oai]

Superseded by #15469, which keeps the parent item id typed without overloading targetItemId.