Handle bio policy errors in Codex

[fc-oai]

Summary

• Treat streamed Responses bio_policy failures as terminal invalid requests instead of retryable stream errors.
• Recognize the new biology policy code and message in the TUI while preserving the legacy invalid_prompt contract.
• Keep the existing dedicated biology safety notice and add regression/snapshot coverage for all supported error shapes.

Why

openai/openai#1068559 gates a Responses API contract change from invalid_prompt and the legacy message to bio_policy and new biology copy.

Without this compatibility change, streamed blocks are retried as transient failures and the OSS TUI falls back to a generic/raw error instead of the dedicated safety notice.

Validation

• just test -p codex-api — 137 passed
• just test -p codex-tui app_server_safety_access_errors_render_dedicated_notice — passed
• just fix -p codex-api
• just fix -p codex-tui
• just fmt
• just test -p codex-tui — 2,957 passed; two reproducible failures remain in untouched Guardian feature-flag persistence tests:
  • update_feature_flags_disabling_guardian_clears_review_policy_and_restores_default
  • update_feature_flags_disabling_guardian_clears_manual_review_policy_without_history

[ftoddywala]

Thank you!