feat(harness-server): add cyber policy model fallback

[decofe]

Summary

• Retry a Codex turn once with CODEX_CYBER_POLICY_FALLBACK_MODEL when the selected model returns a cybersecurity-policy rejection before streaming work.
• Recognize the typed cyberPolicy error and the legacy high-risk-cyber message while preserving the original failure when no distinct fallback is configured.
• Add unit and fake app-server integration coverage for the model switch.

Testing

• cargo test --manifest-path crates/harness-server/Cargo.toml
• cargo +nightly clippy --manifest-path crates/harness-server/Cargo.toml --all-targets -- -D warnings
• cargo test --manifest-path crates/harness-server/Cargo.toml real_codex_long_streaming_uses_native_app_server_chunks -- --ignored --nocapture

Prompted by: @Zygimantass