fix(review): update Codex automatic approval flag

[leoreisdias]

Problem

Codex CLI 0.147 removed the --full-auto argument. Plannotator still passed it when launching Codex review jobs, so standard review, Guided Review, and Code Tour failed before the agent could start:

error: unexpected argument '--full-auto' found

Fix

• Replace --full-auto with the current --approve-for-me flag in all three Codex command builders.
• Keep the existing workspace-write sandbox and automatic approval-review behavior.
• Add one regression test that holds the standard review, guide, and tour builders to the same CLI contract.
• Update the AI code-review guide and privacy disclosure to describe the current flag and behavior.

Review focus

The important invariant is that every Codex review surface launches with the same supported approval flag. The new test deliberately checks all three builders together so future CLI migrations cannot fix one surface while leaving another broken.

Test plan

• 55 focused server tests pass across command building, review ingestion, prompt composition, Guided Review, and Code Tour.
• Generated argv from all three builders is accepted by Codex CLI 0.147.0.
• All seven TypeScript project configurations pass tsc --noEmit with TypeScript 5.8.3.
• git diff --check passes.

Environment note: this worktree's root bun run typecheck wrapper could not locate tsc, so the same seven project configurations were run directly with the existing TypeScript 5.8.3 compiler.