Make the Codex auto-mode approvals reviewer configurable, and document what each runtime mode means per provider

[seankoji]

Problem

In auto mode T3 starts Codex turns with approvalPolicy: "on-request", sandboxPolicy: workspaceWrite and approvalsReviewer: "auto_review" (codexRuntimeModeTurnDefaults). The reviewer choice is not visible or configurable, and it is expensive: on one host that runs Codex almost only through T3, guardian review threads were 396 of 1,009 Codex rollouts in five weeks (39%), and they count against the account's Codex usage limits.

More generally, how each runtime mode maps onto each provider's permissions is only discoverable by reading the code. For example, full-access is Claude bypassPermissions, Codex never + dangerFullAccess, and an OpenCode allow-all session rule; auto is Claude auto, Codex on-request + guardian, and OpenCode * ask outside a fixed list. That makes it hard to reason about where approval prompts and cost come from.

Proposal

1. A setting for the Codex reviewer used in auto mode: automatic review (current) or route to the user, ideally per project.
2. A short table in settings or docs showing what each runtime mode means per provider (permission mode, approval policy, sandbox, reviewer).

Related: #17125 (per-provider default permission mode), #7340 (provider-agnostic auto-guardian).

Why

Users pick a runtime mode once in T3 but pay for, and get prompted by, provider-specific behaviour they cannot see.