feat: expose codex mcp guardian governance

tests/local-agent-codex-app-server-runner.test.mjs

@@ -209,6 +209,28 @@ test("codex app-server discovery includes governance and MCP summaries without l
     notificationOnly: true,
     labels: ["搜索更新", "搜索完成"],
   });
+  assert.deepEqual(metadata.mcpGovernanceSummary, {
+    actionCount: 5,
+    oauthActionCount: 2,
+    resourceActionCount: 1,
+    toolActionCount: 1,
+    elicitationAvailable: true,
+    userInitiatedOnly: true,
+    labels: ["OAuth 登录", "OAuth 完成", "资源读取", "工具调用", "交互请求"],
+  });
+  assert.deepEqual(metadata.userInteractionGovernanceSummary, {
+    actionCount: 1,
+    requestUserInputAvailable: true,
+    userInitiatedOnly: true,
+    labels: ["请求用户输入"],
+  });
+  assert.deepEqual(metadata.guardianGovernanceSummary, {
+    actionCount: 2,
+    approvalActionCount: 1,
+    permissionRequestEventAvailable: true,
+    userInitiatedOnly: true,
+    labels: ["Guardian 放行", "权限请求"],
+  });
 
   const serialized = JSON.stringify(metadata);
   assert.equal(serialized.includes("sk-secret-should-not-leak"), false);