exec: make review-policy tests hermetic

[bolinfest]

Why

thread_start_params_from_config() is supposed to forward the effective approvals_reviewer into the app-server request, but these tests were constructing that config through ConfigBuilder::build(), which also loads ambient system and managed config layers. On machines with an admin or host-level reviewer override, the manual-only case could inherit guardian_subagent and fail even though the exec-side mapping was correct.

What changed

• Set approvals_reviewer explicitly via harness_overrides in the two thread_start_params_*review_policy* tests in codex-rs/exec/src/lib.rs.
• Removed the dependence on default config resolution and temp config.toml writes so the tests exercise only the reviewer-to-request mapping in codex-exec.

Testing

• cargo test -p codex-exec