[6/8] Add high-level Python SDK approval mode (#21910)

## Why

The high-level SDK should expose the approval behavior it actually
supports instead of leaking generated app-server routing fields. New
work should have two clear choices: default auto review, or explicitly
deny escalated permission requests. Existing threads and subsequent
turns should preserve their current approval behavior unless the caller
passes an override.

## What

- Add the public `ApprovalMode` enum with `auto_review` and `deny_all`.
- Default new thread creation to `ApprovalMode.auto_review`.
- Preserve existing approval settings by default for resume, fork, run,
and turn helpers.
- Remove raw `approval_policy` / `approvals_reviewer` kwargs from
high-level SDK wrappers.
- Update generated wrapper output, docs, examples, notebooks, and tests
for the high-level approval mode API.

## Stack

1. #21891 `[1/8]` Pin Python SDK runtime dependency
2. #21893 `[2/8]` Generate Python SDK types from pinned runtime
3. #21895 `[3/8]` Run Python SDK tests in CI
4. #21896 `[4/8]` Define Python SDK public API surface
5. #21905 `[5/8]` Rename Python SDK package to `openai-codex`
6. This PR `[6/8]` Add high-level Python SDK approval mode
7. #22014 `[7/8]` Add Python SDK app-server integration harness
8. #22021 `[8/8]` Add Python SDK Ruff formatting

## Verification

- Added approval-mode mapping/default tests for new threads, existing
threads, forks, resumes, and subsequent turns.

---------

Co-authored-by: Codex <noreply@openai.com>

sdk/python/examples/12_turn_params_kitchen_sink/async.py

@@ -22,7 +22,6 @@ from openai_codex import (
     TextInput,
 )
 from openai_codex.types import (
-    AskForApproval,
     Personality,
     ReasoningSummary,
 )
@@ -46,7 +45,6 @@ PROMPT = (
     "Analyze a safe rollout plan for enabling a feature flag in production. "
     "Return JSON matching the requested schema."
 )
-APPROVAL_POLICY = AskForApproval.model_validate("never")
 
 
 async def main() -> None:
@@ -55,7 +53,6 @@ async def main() -> None:
 
         turn = await thread.turn(
             TextInput(PROMPT),
-            approval_policy=APPROVAL_POLICY,
             output_schema=OUTPUT_SCHEMA,
             personality=Personality.pragmatic,
             summary=SUMMARY,

sdk/python/examples/12_turn_params_kitchen_sink/sync.py

@@ -20,7 +20,6 @@ from openai_codex import (
     TextInput,
 )
 from openai_codex.types import (
-    AskForApproval,
     Personality,
     ReasoningSummary,
 )
@@ -44,14 +43,12 @@ PROMPT = (
     "Analyze a safe rollout plan for enabling a feature flag in production. "
     "Return JSON matching the requested schema."
 )
-APPROVAL_POLICY = AskForApproval.model_validate("never")
 
 with Codex(config=runtime_config()) as codex:
     thread = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
 
     turn = thread.turn(
         TextInput(PROMPT),
-        approval_policy=APPROVAL_POLICY,
         output_schema=OUTPUT_SCHEMA,
         personality=Personality.pragmatic,
         summary=SUMMARY,

sdk/python/examples/13_model_select_and_turn_params/async.py

@@ -16,7 +16,6 @@ from openai_codex import (
     TextInput,
 )
 from openai_codex.types import (
-    AskForApproval,
     Personality,
     ReasoningEffort,
     ReasoningSummary,
@@ -75,7 +74,6 @@ SANDBOX_POLICY = SandboxPolicy.model_validate(
         "access": {"type": "fullAccess"},
     }
 )
-APPROVAL_POLICY = AskForApproval.model_validate("never")
 
 
 async def main() -> None:
@@ -106,7 +104,6 @@ async def main() -> None:
 
         second_turn = await thread.turn(
             TextInput("Return JSON for a safe feature-flag rollout plan."),
-            approval_policy=APPROVAL_POLICY,
             cwd=str(Path.cwd()),
             effort=selected_effort,
             model=selected_model.model,

sdk/python/examples/13_model_select_and_turn_params/sync.py

@@ -14,7 +14,6 @@ from openai_codex import (
     TextInput,
 )
 from openai_codex.types import (
-    AskForApproval,
     Personality,
     ReasoningEffort,
     ReasoningSummary,
@@ -73,7 +72,6 @@ SANDBOX_POLICY = SandboxPolicy.model_validate(
         "access": {"type": "fullAccess"},
     }
 )
-APPROVAL_POLICY = AskForApproval.model_validate("never")
 
 
 with Codex(config=runtime_config()) as codex:
@@ -102,7 +100,6 @@ with Codex(config=runtime_config()) as codex:
 
     second = thread.turn(
         TextInput("Return JSON for a safe feature-flag rollout plan."),
-        approval_policy=APPROVAL_POLICY,
         cwd=str(Path.cwd()),
         effort=selected_effort,
         model=selected_model.model,