Function prefix_rule_migration 

pub async fn prefix_rule_migration(
    codex_home: &Path,
    policy_path: &Path,
    banned_prefixes: &[&[&str]],
) -> Result<()>

removes legacy allow rules that newer codex versions no longer offer.

this migration is intentionally one-shot. once complete, a marker in codex_home prevents policies saved by newer codex versions from being removed on later startups.