buzz-acp: preserve verified scoped owner authority at the provider approval boundary

Routine already-authorized managed-agent work can stop because Buzz's authenticated owner instruction reaches Codex approval review only as transcript text. A trusted integration should retain scoped owner authority without promoting quoted or model-authored text into a permission grant.

@block/buzz-oss-team is the repository CODEOWNERS team; requesting routing to the ACP/runtime maintainer and the provider permission-interface owner. No provider standing-grant interface or maintainer acceptance is established by this report.

Observed installed adapter: `@agentclientprotocol/codex-acp` 1.10.0, artifact SHA-256 `4602784c5896fbf05a7d89b09655bacc768d0bf281e0d03a10333ff81da45268`. The inspected mapping supplies on-request / auto_review / workspaceWrite each turn. Text prompt blocks map to ordinary text items with empty `text_elements`; signed-event IDs and tags in the prompt are not a separately verified provider grant. Existing #7487 reports requested/returned configuration but does not solve this boundary.

Concrete observed classes: internal same-channel callback rejected; routine recurring configuration rejected after contextual owner authorization; private-account access rejected before selection. An explicit denial remained in force and none was retried via another tool or weaker mode. This is evidence about those actions, not a claim all auto-review decisions fail.

Requested narrow integration:

1. Verify original owner signature and channel/task scope outside model text. Bind any provider-supported authorization to exact action class, target/recipient/material revision where relevant, expiry/revocation and dedupe.
2. Negotiate a documented provider permission capability; report unsupported when unavailable. Do not implement a local “trusted” label and assume the reviewer accepts it.
3. Read back effective reviewer, sandbox, policy sources/version and accepted scope; distinguish requested/submitted/acknowledged from provider-attested state.
4. Preserve one required action-time confirmation, without demanding duplicate scripted wording for the same scoped decision. New money/capital, public release, personal representation, destructive/security expansion and unresolved prior-effect uncertainty retain their gates.
5. Record denied/blocked task and failed callback durably, with an independently delivered owner deadline alert. A successful turn or relay message is not successful execution.

Acceptance must include real disposable managed integration, not prompt fixtures alone: signed contextual decision; bounded recurring schedule; internal handoff; ordinary non-personal communication; confirmation dedupe; forged/agent-only authority rejection; wrong channel/recipient/revision, expired/revoked scope and uncertain-effect replay rejection. Include natural scheduler→agent→local no-action artifact→callback plus a deliberately absent wake and denial path. Separate tests must cover any consequential action capability.

Official constraints: https://learn.chatgpt.com/docs/sandboxing/auto-review . Auto-review keeps the sandbox; full policy replacement requires the complete active policy and yields to managed policy. The TUI exact-action override is one retry, not recurring authorization. Switching to full access or automatic allow_once is not the proposed fix.

Related: #3710, #3715, #5322, #7065, #7066, #7487. Please identify the supported provider interface, accountable implementation owner and release/readback checkpoint. Until then routine supported local work and accepted internal reporting continue, while denied actions remain blocked.