Add diagnostics for read_only_unless_trusted timeout flake

[aibrahim-oai]

Summary

• add targeted diagnostic logging for the read_only_unless_trusted_requires_approval scenarios in approval_matrix_covers_all_modes
• add a scoped timeout buffer only for ro_unless_trusted write-file scenarios: 1000ms -> 2000ms
• keep all other write-file scenarios at 1000ms

Why

The last two main failures were both in codex-core::all suite::approvals::approval_matrix_covers_all_modes with exit_code=124 in the same scenario. This points to execution-time jitter in CI rather than a semantic approval-policy mismatch.

Notes

• This does not introduce any >5s timeout and does not disable/quarantine tests.
• The timeout increase is tightly scoped to the single flaky path and keeps the matrix deterministic under CI scheduling variance.