test: accept codex not-approved fallback

(cherry picked from commit 542086ccea)

src/gateway/gateway-codex-harness.live-helpers.test.ts

@@ -47,6 +47,7 @@ describe("gateway codex harness live helpers", () => {
       "I couldn’t list them because `codex models` requires running outside the sandbox here, and that approval was rejected.",
       "I couldn’t list them because the local `codex models` command requires elevated execution in this environment, and that request was rejected.",
       "I couldn’t list them because the local `codex models` command requires host permissions here, and that escalation was rejected.",
+      "I couldn’t run `codex models` because the sandboxed attempt failed and the required elevated retry was not approved.",
     ];
 
     for (const text of texts) {

src/gateway/gateway-codex-harness.live-helpers.ts

@@ -57,7 +57,7 @@ export function isExpectedCodexModelsCommandText(text: string): boolean {
       normalized.includes("fails to start") ||
       normalized.includes("repo-local fallback") ||
       normalized.includes("sandbox blocks") ||
-      (normalized.includes("rejected") &&
+      ((normalized.includes("rejected") || normalized.includes("not approved")) &&
         (normalized.includes("sandbox") ||
           normalized.includes("permission") ||
           normalized.includes("permissions") ||