feat(prompts): adopt upstream system-prompt improvements (merged with our customizations)

[andrei-hasna]

What

Adopt genuinely-useful system-prompt / model-facing-instruction improvements that openai/codex landed upstream since our fork point (ed6e5cf9, 2026-06-07 → upstream/main 2026-07-20, ~1140 commits), merged line-by-line onto our customized prompt files — never a blind overwrite. Every Codewith customization is preserved.

This is a model-behavior-affecting "combine". Opened for maintainer review — please do not auto-merge.

Adopted (upstream improvement folded onto our files)

File	Upstream improvement	How it was merged
codex-rs/core/src/guardian/policy_template.md	New evidence bullet: when an MCP planned action includes connected_account_email, use it to judge which account owns a connected destination; don't infer ownership from the connector alone.	Added the bullet only. Kept our single-brace {tenant_policy_config} placeholder — our renderer uses str::replace, not upstream's {{ }} engine.
codex-rs/ext/web-search/web_run_description.md	New ## Citations section (markdown-link citation rules + placement); removes the weak trailing "Make sure to provide links" line.	Applied verbatim (no local customization existed here).
codex-rs/collaboration-mode-templates/templates/plan.md	Clarifies Plan-mode follow-ups after a prior <proposed_plan> (incomplete revision vs. clarifying question).	Appended the upstream sentence to the existing final line.
codex-rs/tui/prompt_for_init_command.md	"Before writing, check whether the init file already exists; if so, do not overwrite it."	Adopted the guidance, rewritten to our .codewith/CODEWITH.md branding (upstream says AGENTS.md).

Preserved-ours (deliberately NOT adopted)

• "non-interactive approval modes like never or on-failure" wording in gpt_5_1_prompt.md, gpt_5_2_prompt.md, prompt_with_apply_patch_instructions.md, protocol/.../base_instructions/default.md, models-manager/prompt.md. Upstream trimmed this to only **never** as part of deleting the on-failure approval mode entirely. Our fork still ships AskForApproval::OnFailure (protocol/src/protocol.rs), so the wording stays accurate for us — this is a conflict resolved in our favor, not a missed improvement.
• prompts/templates/permissions/approval_policy/on_failure.md and prompts/templates/agents/hierarchical.md — deleted upstream, but still include_str!'d by our code (permissions_instructions.rs; prompts/src/agents.rs → core/src/agents_md.rs). Kept.
• ext/image-generation/imagegen_description.md — upstream rewrote the Guidelines block around new tool params (referenced_image_paths, num_last_images_to_include, view_image) that our tool does not expose (our tool has action generate/edit + generatedImage(result)). Kept ours, including the images.imagegen namespace (upstream uses reserved image_gen).
• Guardian {{ }} templating switch — code-coupled to a templating engine we do not use.
• Codewith / Hasna branding and the infinity-agent / adversarial-agent goal templates (prompts/templates/goals/*.md, ext/goal/templates/goals/*.md) — untouched (also unchanged upstream).

Out of scope (noted; belongs elsewhere)

Upstream also refactored prompt-building code (context/*_instructions.rs world_state migration, collaboration_mode → multi_agent_mode rename, code-mode → code-mode-protocol move). Those are structural code refactors, not prompt-text improvements, and conflict heavily with our fork — they belong in the other upstream-sync/cluster-* PRs, not here.

Verification (warm blacksmith box, whole workspace — never compiled locally)

• just check-fast (whole workspace --all): PASS — every crate compiles, so every include_str!'d prompt embeds cleanly.
• just test-fast (whole workspace --all): 12470 tests, 12401 passed, 22 skipped, 69 failed. All 69 are the known-environmental landlock/seccomp exec-sandbox + process-spawn/external-CLI tests. Verified by test name against the origin/main parent baseline (1442206eb) run on the same box: this PR adds ZERO new failures. The only run-to-run deltas are 6 codex-app-server ...background_agent_live::* (worker-process spawn → 10s timeouts) and codex-hooks fleet_comms::command_*_conversations_cli (absent conversations CLI), proven flaky by a 3× targeted re-run (fleet_comms flips PASS/FAIL). None relate to the 4 changed markdown files.
• just clippy (whole workspace --tests): PASS (exit 0).
• cargo fmt -- --check: PASS (exit 0) on both this branch and the parent baseline. (The diff touches zero .rs files — git diff --name-only 1442206eb -- '*.rs' is empty.) The just fmt-check recipe returns non-zero only from its separate just --unstable --fmt --check step over the justfile itself — a pre-existing main-branch state issue (see the existing style/fix-rustfmt-main branch), independent of this PR.

Secret-scanned (public repo): clean. No Co-Authored-By trailers.