chore(core) rm AskForApproval::OnFailure (#28418)

## Summary
Deletes the OnFailure variant of the `AskForApproval` enum. This option
has been deprecated since #11631.

## Testing
- [x] Tests pass

codex-rs/prompts/src/permissions_instructions.rs

@@ -18,8 +18,6 @@ const APPROVAL_POLICY_NEVER: &str =
     include_str!("../templates/permissions/approval_policy/never.md");
 const APPROVAL_POLICY_UNLESS_TRUSTED: &str =
     include_str!("../templates/permissions/approval_policy/unless_trusted.md");
-const APPROVAL_POLICY_ON_FAILURE: &str =
-    include_str!("../templates/permissions/approval_policy/on_failure.md");
 const APPROVAL_POLICY_ON_REQUEST_RULE: &str =
     include_str!("../templates/permissions/approval_policy/on_request.md");
 const APPROVAL_POLICY_ON_REQUEST_AUTO_REVIEW: &str =
@@ -231,7 +229,6 @@ fn approval_text(
         AskForApproval::UnlessTrusted => {
             with_request_permissions_tool(APPROVAL_POLICY_UNLESS_TRUSTED)
         }
-        AskForApproval::OnFailure => with_request_permissions_tool(APPROVAL_POLICY_ON_FAILURE),
         AskForApproval::OnRequest => on_request_instructions(),
         AskForApproval::Granular(granular_config) => granular_instructions(
             granular_config,

codex-rs/prompts/src/permissions_instructions_tests.rs

@@ -175,26 +175,6 @@ fn includes_request_permissions_tool_instructions_for_unless_trusted_when_enable
     assert!(text.contains("# request_permissions Tool"));
 }
 
-#[test]
-fn includes_request_permissions_tool_instructions_for_on_failure_when_enabled() {
-    let instructions = PermissionsInstructions::from_permissions_with_network(
-        SandboxMode::WorkspaceWrite,
-        NetworkAccess::Enabled,
-        PermissionsPromptConfig {
-            approval_policy: AskForApproval::OnFailure,
-            approvals_reviewer: ApprovalsReviewer::User,
-            exec_policy: &Policy::empty(),
-            exec_permission_approvals_enabled: false,
-            request_permissions_tool_enabled: true,
-        },
-        /*writable_roots*/ None,
-    );
-
-    let text = instructions.body();
-    assert!(text.contains("`approval_policy` is `on-failure`"));
-    assert!(text.contains("# request_permissions Tool"));
-}
-
 #[test]
 fn includes_request_permission_rule_instructions_for_on_request_when_enabled() {
     let instructions = PermissionsInstructions::from_permissions_with_network(

codex-rs/prompts/templates/permissions/approval_policy/on_failure.md

@@ -1 +0,0 @@
-Approvals are your mechanism to get user consent to run shell commands without the sandbox. `approval_policy` is `on-failure`: The harness will allow all commands to run in the sandbox (if enabled), and failures will be escalated to the user for approval to run again without the sandbox.