Summary

• Keep the guardian policy installed as guardian base instructions.
• Clear inherited parent developer_instructions for guardian review sessions.
• Update guardian config tests to assert developer instructions are cleared and policy text is sourced from base instructions.

Why

Guardian review sessions are intended to run under an isolated guardian policy. Because the guardian config is cloned from the parent config, inherited custom or managed developer instructions could otherwise remain active and conflict with guardian review behavior.

Validation

• just fmt
• cargo test -p codex-core guardian_review_session_config