Allow individual `prefix_rule` entries to require human approval while keeping `approvals_reviewer = "auto_review"` enabled globally

What variant of Codex are you using?

CLI

What feature would you like to see?

I want automatic review for most actions, but want to manually approve every
SSH, rsync, and SCP command because they access remote servers and may transfer
sensitive data.

My current configuration:

approvals_reviewer = "auto_review"

prefix_rule(
    pattern = [["ssh", "rsync", "scp"]],
    decision = "prompt",
    justification = "Remote access requires manual approval",
)

The matching commands still go through auto-review instead of prompting me.
The justification does not enforce human review.

## Proposed behavior

Support an optional reviewer override:

prefix_rule(
    pattern = [["ssh", "rsync", "scp"]],
    decision = "prompt",
    reviewer = "user",
    justification = "Remote access requires manual approval",
)

- Without an override, use the globally configured reviewer.
- With reviewer = "user", require explicit human approval for each invocation.
- If multiple rules match, a human-review requirement should take precedence
  over automatic review; forbidden should still block execution.

- Shell-wrapper handling should preserve the requirement whenever Codex
  identifies a matching command inside a compound command.

## Current limitation

In codex-cli 0.153.4, adding reviewer = "user" fails with:

> Found reviewer extra named parameter(s) for call to prefix_rule

Switching the global reviewer to user disables automatic review for all other
actions. An instruction in AGENTS.md to ask first is not equivalent to an
enforced approval gate.

### Additional information

_No response_

Start by tracing how prefix_rule entries are parsed and how approvals_reviewer is selected for matching CLI commands. Check the existing handling of prompt, auto_review, forbidden, and compound shell commands. Done means an optional reviewer override is accepted, human review takes precedence over automatic review for matching rules, forbidden still blocks execution, and relevant tests cover these cases.