Support PermissionRequest hook deny interrupts

[abhinav-oai]

Summary

• allow PermissionRequest hook handlers to return decision.interrupt: true when denying a request
• route interrupting denies through the existing interrupted-turn lifecycle so the agent loop stops with TurnAbortReason::Interrupted
• add end-to-end coverage for an interrupting shell_command denial and update the generated hook schema fixture

Why

This extends the permission-request hook contract so a deny can optionally behave like an Esc interrupt instead of only surfacing as a normal approval rejection.

Implementation

• parse and carry interrupt only for deny decisions in the hooks crate
• map interrupting denies to session.interrupt_task() in the core approval paths
• treat interrupted in-flight tool futures as normal turn aborts during drain

Validation

• cargo test -p codex-hooks
• cargo test -p codex-core --test all permission_request_hook_interrupts_shell_command_turn
• cargo test -p codex-core

Notes

• This PR is stacked on codex/permission-request-hooks-base (Add PermissionRequest hooks support #17563).
• The local cargo test -p codex-core run still reported two unrelated failures in this environment:
  • plugins::manager::tests::list_marketplaces_ignores_installed_roots_missing_from_config
  • tools::js_repl::tests::js_repl_imported_local_files_can_access_repl_globals