[release/0.144] fix(core) expand is_dangerous_command

[dylan-hurd-oai]

Summary

Cherry-picks the seven commits from openai/codex-internal#1942 onto release/0.144.

This backport:

1. enables dangerous-command detection in danger-full-access mode
2. expands literal Bash parsing so additional forced rm forms are detected
3. returns a specific rejection reason to the model when a dangerous command is denied

The commits applied without conflicts or release-only changes. git range-diff confirms every cherry-picked patch matches the source PR exactly.

Validation

• just test -p codex-shell-command (141 passed)
• just test -p codex-core exec_policy (107 passed)
• just test -p codex-core outside the sandbox (2,947 passed; 4 unrelated environment/setup failures)
  • 3 RMCP tests could not locate the test-only test_stdio_server binary
  • 1 user-shell environment test observed the tool runner's mandated CODEX_SANDBOX_NETWORK_DISABLED=1
• just fix -p codex-core
• just fix -p codex-shell-command
• just fmt
• git diff --check