[codex core] Harden fake shell approval boundaries

[bookholt-oai]

Why

A model-selected or nested path-qualified shell could be reduced to its inner command during approval analysis. A fake shell wrapping a known-safe command such as ls could therefore inherit the inner command's trust, including when the call requested a sandbox expansion. Approval-cache normalization and proposed durable rules also discarded the outer shell context.

What

• Treat sandbox expansion as an approval boundary before known-safe command classification.
• Keep path-qualified model-selected and nested shell wrappers from inheriting trust from their inner command.
• Suppress durable exec-policy amendments for sandbox overrides and model-selected shells.
• Preserve Bash and PowerShell executable identity and execution-affecting wrapper arguments in approval-cache keys.
• Add Unix and Windows path-spelling, policy-mode, cache-key, and approve-once/prompt-again regressions.

How

Unified exec now carries whether the shell was configured or model-selected into exec-policy evaluation. Model-selected path shells and nested path-qualified shell wrappers use a fail-closed origin, while explicit user-authored allow rules retain their existing precedence. Cross-platform path qualification handles Unix, Windows drive, UNC, and backslash spellings.

Testing

• just test -p codex-core exec_policy — 105 passed.
• just test -p codex-core command_canonicalization — 6 passed.
• Unified-exec approval matrix plus sandbox-override non-persistence regressions — 3 passed.
• just fix -p codex-core — clean.
• just fmt — clean.

A local all-core attempt was not used as a green signal because its harness lacked the stdio test fixture and its realtime tests timed out; the affected approval tests pass in isolation. GitHub CI remains the authoritative full-run signal.

Tracking: BUGB-17231