refactor(agent): clone the review snapshot once at the spawn chokepoint

Move the structural clone from the four call sites (auto review, codex
runtime, CLI /refine, gateway /refine) into AIAgent._spawn_background_review,
which every review path — immediate, idle-queue deferred, requeued — passes
through. Callers can no longer forget it, and the private helper is no longer
imported across hermes_cli/ and gateway/ package boundaries.

Tests now bind the real chokepoint (capturing at _spawn_background_review_now)
so they still fail if the clone is removed.

agent/codex_runtime.py

@@ -933,15 +933,8 @@ def run_codex_app_server_turn(
         and (should_review_memory or should_review_skills)
     ):
         try:
-            # Keep the review fork's in-place transcript normalization from
-            # mutating the live foreground messages after persistence.  A
-            # shallow list copy still aliases nested tool-call/content data,
-            # which can make the next rebuilt request diverge from the cached
-            # prefix.
-            from agent.turn_finalizer import _clone_background_review_messages
-
             agent._spawn_background_review(
-                messages_snapshot=_clone_background_review_messages(messages),
+                messages_snapshot=list(messages),
                 review_memory=should_review_memory,
                 review_skills=should_review_skills,
             )