Fix/win approvals canonicalize

[cpjet64]

Persist approval keys across Windows shells and volatile args

Problem & intent

“Allow every time / for this session” approvals didn’t persist across Windows shells because approval keys included wrappers (pwsh/cmd/wsl/bash -lc) or volatile args (e.g., sed ranges).
Users were re‑prompted for equivalent actions that should have been considered identical approvals.

• Addresses: Windows approval “Allow for this session” isn’t remembered #4212, "Allow every time" is asked every time #4603, Selecting "always" doesn't work in session #3691
• Also addresses: auto approve not working - mingw64 - mingw #5199 (auto‑approve persistence for MINGW)

---

Before / After

Before
Approval keys were based on full argv; wrapper or volatile‑arg differences caused repeated prompts for logically identical commands.

After

• Approvals now persist across PowerShell 5/7, Git Bash/MSYS2/MINGW, and WSL.
• Keys are normalized by stripping wrappers and, for sed, de‑noising numeric ranges.
• Canonicalization preserves arguments while ignoring shell wrappers or volatile digits.

---

Scope of change

codex-rs/core/src/tools/runtimes/shell.rs

• strip_wrapper() handles wsl/bash/cmd/pwsh/powershell launchers.
• canonicalize() preserves full argv; only sed script tokens normalized (digits → N). rg untouched.
• Multi‑key lookup order: RAW → STRIPPED → CANONICAL.
• Added negative test verifying sed -n 10,20p safe.txt ≠ sed -n 10,20p secrets.txt.

codex-rs/core/src/tools/sandboxing.rs

• ApprovalStore::get_any() and put_all() implement ordered multi‑key lookup/store.

---

Security effects

None. No new capabilities; deduplicates approvals already granted.
Approval caching remains scoped and sandbox‑checked.

---

Testing evidence

Static

• cargo fmt (workspace): clean
• cargo clippy -p codex-core -- -D warnings → clean

Unit tests (cargo test -p codex-core)

• approvals_match_across_windows_wrappers_and_sed_ranges
• approvals_match_rg_across_pwsh_bash_and_preserve_pattern
• shell_requires_initial_approval_for_dangerous_command
• approvals_cache_allows_dangerous_command_across_wrappers
• sed_canonicalization_does_not_cross_files

All targeted tests pass. Approval persistence verified across environments.

---

Notes

• Runtime delta ≈ 36 LOC (excluding tests).
• No CRLF, TUI, PATH/PATHEXT, or env‑related changes.
• Fully validated against clippy and tests; safe command gating unchanged.

---

Checklist

• Approvals persist across PowerShell, Bash/MSYS2, and WSL
• Volatile sed ranges normalized safely
• cargo fmt / clippy clean
• All unit tests pass (codex-core)
• No behavioral or privilege expansion
• Rollback plan documented
• Addresses Windows approval “Allow for this session” isn’t remembered #4212, "Allow every time" is asked every time #4603, Selecting "always" doesn't work in session #3691, auto approve not working - mingw64 - mingw #5199