fix(exec-policy) use is_known_safe_command less (#20305)

## Summary
Restricts behavior of `is_known_safe_command` only to modes where it is
explicitly part of the documented behavior:
- when `environment_lacks_sandbox_protections`
- in `AskForApproval::UnlessTrusted`

Notably, as a result of this, escalations for commands that pass
`is_known_safe_commands` are no longer auto-approved in
AskForApproval::OnRequest or AskForApproval::Granular.

## Testing
- [x] Updated unit tests
- [x] Updated approvals scenario tests.

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/core/src/exec_policy.rs

@@ -649,9 +649,6 @@ pub(crate) fn render_decision_for_unmatched_command(
             codex_shell_command::is_safe_command::is_safe_powershell_words(command)
         }
     };
-    if is_known_safe && !used_complex_parsing {
-        return Decision::Allow;
-    }
 
     // On Windows, ReadOnly sandbox is not a real sandbox, so special-case it
     // here.
@@ -662,6 +659,14 @@ pub(crate) fn render_decision_for_unmatched_command(
             sandbox_cwd,
         );
 
+    if is_known_safe
+        && !used_complex_parsing
+        && (approval_policy == AskForApproval::UnlessTrusted
+            || environment_lacks_sandbox_protections)
+    {
+        return Decision::Allow;
+    }
+
     // If the command is flagged as dangerous or we have no sandbox protection,
     // we should never allow it to run without approval.
     //