[codex-analytics] guardian review analytics schema polishing

[rhan-oai]

Why

Guardian review analytics needs a Rust event shape that matches the backend schema while avoiding unnecessary PII exposure from reviewed tool calls. This PR narrows the analytics payload to the fields we intend to emit and keeps shared Guardian assessment enums in protocol instead of duplicating equivalent analytics-only enums.

What changed

• Uses protocol Guardian enums directly for risk_level, user_authorization, outcome, and command source values.
• Removes high-risk reviewed-action fields from the analytics payload, including raw commands, display strings, working directories, file paths, network targets/hosts, justification text, retry reason, and rationale text.
• Makes target_item_id and tool_call_count nullable so the Codex event can represent cases where the app-server protocol or producer does not have those values.
• Keeps lower-risk structured reviewed-action metadata such as sandbox permissions, permission profile, tty, execve source/program, network protocol/port, and MCP connector/tool labels.
• Adds an analytics reducer/client test covering codex_guardian_review serialization with an optional target_item_id and absent removed fields.

Verification

• cargo test -p codex-analytics guardian_review_event_ingests_custom_fact_with_optional_target_item
• cargo fmt --check

---

Stack created with Sapling. Best reviewed with ReviewStack.

• [codex-analytics] guardian review TTFT plumbing and emission #17696
• [codex-analytics] guardian review truncation #17695
• [codex-analytics] guardian review analytics events emission #17693
• -> [codex-analytics] guardian review analytics schema polishing #17692