unified-exec: retain PathUri in command events (#28780)

## Why

App-server must report command events containing foreign-platform paths
without changing existing client or rollout path-string formats.

## What changed

- retain `PathUri` through exec command begin/end events
- convert cwd values to `LegacyAppPathString` at the app-server
compatibility boundary
- drop command actions with foreign paths and log them
- serialize rollout-trace cwd values using their inferred native path
representation
- restore Wine coverage for retained Windows cwd values and successful
completion

codex-rs/app-server/src/bespoke_event_handling.rs

@@ -113,6 +113,7 @@ use codex_protocol::request_user_input::RequestUserInputResponse as CoreRequestU
 use codex_sandboxing::policy_transforms::intersect_permission_profiles;
 use codex_shell_command::parse_command::shlex_join;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_path_uri::LegacyAppPathString;
 use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::SystemTime;
@@ -129,7 +130,7 @@ enum CommandExecutionApprovalPresentation {
 #[derive(Debug, PartialEq)]
 struct CommandExecutionCompletionItem {
     command: String,
-    cwd: AbsolutePathBuf,
+    cwd: LegacyAppPathString,
     command_actions: Vec<V2ParsedCommand>,
 }
 
@@ -575,7 +576,7 @@ pub(crate) async fn apply_bespoke_event_handling(
                 let command_string = shlex_join(&command);
                 let completion_item = CommandExecutionCompletionItem {
                     command: command_string,
-                    cwd: cwd.clone(),
+                    cwd: cwd.clone().into(),
                     command_actions: command_actions.clone(),
                 };
                 CommandExecutionApprovalPresentation::Command(completion_item)
@@ -1354,7 +1355,7 @@ async fn start_command_execution_item(
     turn_id: String,
     item_id: String,
     command: String,
-    cwd: AbsolutePathBuf,
+    cwd: LegacyAppPathString,
     command_actions: Vec<V2ParsedCommand>,
     source: CommandExecutionSource,
     outgoing: &ThreadScopedOutgoingMessageSender,
@@ -1398,7 +1399,7 @@ async fn complete_command_execution_item(
     turn_id: String,
     item_id: String,
     command: String,
-    cwd: AbsolutePathBuf,
+    cwd: LegacyAppPathString,
     process_id: Option<String>,
     source: CommandExecutionSource,
     command_actions: Vec<V2ParsedCommand>,
@@ -2323,7 +2324,7 @@ mod tests {
     fn command_execution_completion_item(command: &str) -> CommandExecutionCompletionItem {
         CommandExecutionCompletionItem {
             command: command.to_string(),
-            cwd: test_path_buf("/tmp").abs(),
+            cwd: test_path_buf("/tmp").abs().into(),
             command_actions: vec![V2ParsedCommand::Unknown {
                 command: command.to_string(),
             }],

codex-rs/app-server/src/request_processors.rs

@@ -553,8 +553,7 @@ fn resolve_turn_environment_selections(
         let environment_id = environment.environment_id;
         let cwd = environment
             .cwd
-            .infer_absolute_path_convention()
-            .and_then(|convention| environment.cwd.to_path_uri(convention).ok())
+            .to_inferred_path_uri()
             .ok_or_else(|| {
                 invalid_request(format!(
                     "invalid cwd for environment `{environment_id}`: path `{}` does not use absolute POSIX or Windows path syntax",

codex-rs/app-server/src/transport_tests.rs

@@ -254,7 +254,7 @@ async fn command_execution_request_approval_strips_additional_permissions_withou
                     reason: Some("Need extra read access".to_string()),
                     network_approval_context: None,
                     command: Some("cat file".to_string()),
-                    cwd: Some(absolute_path("/tmp")),
+                    cwd: Some(absolute_path("/tmp").into()),
                     command_actions: None,
                     additional_permissions: Some(
                         codex_app_server_protocol::AdditionalPermissionProfile {
@@ -320,7 +320,7 @@ async fn command_execution_request_approval_keeps_additional_permissions_with_ca
                     reason: Some("Need extra read access".to_string()),
                     network_approval_context: None,
                     command: Some("cat file".to_string()),
-                    cwd: Some(absolute_path("/tmp")),
+                    cwd: Some(absolute_path("/tmp").into()),
                     command_actions: None,
                     additional_permissions: Some(
                         codex_app_server_protocol::AdditionalPermissionProfile {