Use issuing step settings for approval decisions (#40821)

## Why

Tool actions and approval retries can outlive the step that issued them. If approval handling reads newer turn settings, a delayed action can use the wrong approval policy or reviewer.

## What changed

- Capture the approval policy and reviewer in `GuardianReviewContext` from the issuing step.
- Use step settings for command, patch, permission, sandbox-retry, and remote-network approval decisions.
- Use the active task's published settings for background network approvals and long-lived Unix shell interception.
- Preserve explicit MCP reviewer overrides.

## Testing

Added regression coverage for permission requests, same-turn network policy changes, delayed commands after a new turn starts, sandbox retries, patch policy selection, and MCP reviewer overrides.

GitOrigin-RevId: b7e84a2e1e79a71502272b15b5ef5b0e5643f8b0