chore(core) rm AskForApproval::OnFailure (#28418)

## Summary
Deletes the OnFailure variant of the `AskForApproval` enum. This option
has been deprecated since #11631.

## Testing
- [x] Tests pass

codex-rs/core/tests/suite/remote_env.rs

@@ -315,151 +315,6 @@ async fn explicit_remote_shell_runs_in_remote_cwd() -> Result<()> {
     Ok(())
 }
 
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn remote_sandbox_denial_requests_approval_and_retries() -> Result<()> {
-    skip_if_no_network!(Ok(()));
-    skip_if_wine_exec!(Ok(()), "requires the Docker-backed POSIX executor");
-    let Some(_remote_env) = get_remote_test_env() else {
-        return Ok(());
-    };
-
-    const CALL_ID: &str = "remote-sandbox-denial";
-    const CONTENTS: &str = "remote sandbox retry succeeded";
-
-    let server = start_mock_server().await;
-    let test = unified_exec_test(&server).await?;
-    let nonce = SystemTime::now().duration_since(UNIX_EPOCH)?.as_millis();
-    let remote_cwd = PathBuf::from(format!("/tmp/codex-remote-denial-cwd-{nonce}")).abs();
-    let target_path = PathBuf::from(format!("/tmp/codex-remote-denial-target-{nonce}")).abs();
-    let remote_cwd_uri = PathUri::from_host_native_path(&remote_cwd)?;
-    let target_uri = PathUri::from_host_native_path(&target_path)?;
-    test.fs()
-        .create_directory(
-            &remote_cwd_uri,
-            CreateDirectoryOptions { recursive: true },
-            /*sandbox*/ None,
-        )
-        .await?;
-    test.fs()
-        .remove(
-            &target_uri,
-            RemoveOptions {
-                recursive: false,
-                force: true,
-            },
-            /*sandbox*/ None,
-        )
-        .await?;
-
-    let command = format!("printf {CONTENTS:?} > {target_path:?} && cat {target_path:?}");
-    let response_mock = mount_sse_sequence(
-        &server,
-        vec![
-            sse(vec![
-                ev_response_created("resp-remote-denial-1"),
-                ev_function_call(
-                    CALL_ID,
-                    "exec_command",
-                    &json!({
-                        "shell": "/bin/sh",
-                        "cmd": command,
-                        "login": false,
-                        "yield_time_ms": 5_000,
-                        "environment_id": REMOTE_ENVIRONMENT_ID,
-                    })
-                    .to_string(),
-                ),
-                ev_completed("resp-remote-denial-1"),
-            ]),
-            sse(vec![
-                ev_response_created("resp-remote-denial-2"),
-                ev_assistant_message("msg-remote-denial", "done"),
-                ev_completed("resp-remote-denial-2"),
-            ]),
-        ],
-    )
-    .await;
-
-    submit_turn_with_approval_and_environments(
-        &test,
-        "retry a sandbox-denied command in the remote environment",
-        vec![TurnEnvironmentSelection {
-            environment_id: REMOTE_ENVIRONMENT_ID.to_string(),
-            cwd: PathUri::from_abs_path(&remote_cwd),
-        }],
-        AskForApproval::OnFailure,
-    )
-    .await?;
-
-    let event = wait_for_event(&test.codex, |event| {
-        matches!(
-            event,
-            EventMsg::ExecApprovalRequest(_) | EventMsg::TurnComplete(_)
-        )
-    })
-    .await;
-    let EventMsg::ExecApprovalRequest(approval) = event else {
-        panic!("expected remote sandbox approval before completion: {event:?}");
-    };
-    assert_eq!(approval.call_id, CALL_ID);
-    assert_eq!(
-        approval.environment_id.as_deref(),
-        Some(REMOTE_ENVIRONMENT_ID)
-    );
-    assert_eq!(
-        approval.reason.as_deref(),
-        Some("command failed; retry without sandbox?")
-    );
-
-    test.codex
-        .submit(Op::ExecApproval {
-            id: approval.effective_approval_id(),
-            turn_id: None,
-            decision: ReviewDecision::Approved,
-        })
-        .await?;
-    wait_for_event(&test.codex, |event| {
-        matches!(event, EventMsg::TurnComplete(_))
-    })
-    .await;
-
-    assert!(
-        response_mock
-            .function_call_output_text(CALL_ID)
-            .is_some_and(|output| output.contains(CONTENTS)),
-        "approved retry should return the remote command output"
-    );
-    assert_eq!(
-        test.fs()
-            .read_file_text(&target_uri, /*sandbox*/ None)
-            .await?,
-        CONTENTS
-    );
-
-    test.fs()
-        .remove(
-            &target_uri,
-            RemoveOptions {
-                recursive: false,
-                force: true,
-            },
-            /*sandbox*/ None,
-        )
-        .await?;
-    test.fs()
-        .remove(
-            &remote_cwd_uri,
-            RemoveOptions {
-                recursive: true,
-                force: true,
-            },
-            /*sandbox*/ None,
-        )
-        .await?;
-
-    Ok(())
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn deferred_executor_does_not_duplicate_initial_environment_context() -> Result<()> {
     let server = start_mock_server().await;