Use Codex auto-review for rescue task escalations

Summary

/codex:rescue currently forces delegated Codex task runs into plugin-selected sandbox modes, but there does not appear to be an auto-review escalation path for commands that need to step outside the workspace sandbox.

A useful middle ground would be for write-capable rescue tasks to start Codex with workspace write access plus Codex auto-review approval routing:

{
  "sandbox": "workspace-write",
  "approvalPolicy": "on-request",
  "approvalsReviewer": "auto_review"
}

That should let normal repo edits proceed directly while still giving Codex a reviewed path for cases like writing to an allowed external docs tree, using local services, or other operations that are blocked by the default sandbox.

Why This Helps

Today the practical choice seems to be either:

• keep Codex sandboxed and have some delegated tasks fail when they need escalation, or
• ask for full access explicitly, which is useful but much blunter.

Using auto_review for write-capable rescue runs would make /codex:rescue more useful by default without making full host access the default.

Related

Related to #145, but this is narrower: not just exposing a full-access flag, but enabling Codex auto-review escalation for the normal write-capable rescue workflow.

Start by tracing the /codex:rescue command and how it constructs delegated Codex task runs. Check where sandbox and approval settings are selected, then verify the write-capable workflow uses workspace-write, on-request, and auto_review without changing the full-access path. Done means the relevant tests or manual command checks confirm normal edits still work and escalation is routed for review.