Make auto-review denial short-circuit use a rolling review window

[won-openai]

Why

Long-running turns can accumulate enough denied auto-review decisions to trip the global short-circuit even when those denials are spread far apart. The breaker should still stop genuinely bad loops, but it should judge recent behavior instead of lifetime turn history.

What changed

• Replaced the lifetime 10 total denials threshold with 10 denials in the last 50 reviews.
• Kept the existing 3 consecutive denials interrupt behavior unchanged.
• Tracked recent auto-review outcomes in the circuit breaker and updated the warning copy to report the rolling-window count.
• Renamed the new rolling-window coverage to auto_review_* test names.
• Added coverage that confirms older denials fall out of the 50-review window and no longer trigger the breaker.

Validation

• just fmt
• cargo test -p codex-core guardian_rejection_circuit_breaker --lib
• cargo test -p codex-core auto_review_rejection_circuit_breaker --lib