feat: pass helper executable paths via Arg0DispatchPaths (#12719)

## Why

`codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs` previously
located `codex-execve-wrapper` by scanning `PATH` and sibling
directories. That lookup is brittle and can select the wrong binary when
the runtime environment differs from startup assumptions.

We already pass `codex-linux-sandbox` from `codex-arg0`;
`codex-execve-wrapper` should use the same startup-driven path plumbing.

## What changed

- Introduced `Arg0DispatchPaths` in `codex-arg0` to carry both helper
executable paths:
  - `codex_linux_sandbox_exe`
  - `main_execve_wrapper_exe`
- Updated `arg0_dispatch_or_else()` to pass `Arg0DispatchPaths` to
top-level binaries and preserve helper paths created in
`prepend_path_entry_for_codex_aliases()`.
- Threaded `Arg0DispatchPaths` through entrypoints in `cli`, `exec`,
`tui`, `app-server`, and `mcp-server`.
- Added `main_execve_wrapper_exe` to core configuration plumbing
(`Config`, `ConfigOverrides`, and `SessionServices`).
- Updated zsh-fork shell escalation to consume the configured
`main_execve_wrapper_exe` and removed path-sniffing fallback logic.
- Updated app-server config reload paths so reloaded configs keep the
same startup-provided helper executable paths.

## References

- [`Arg0DispatchPaths`
definition](https://github.com/openai/codex/blob/e355b43d5c2a771f045296a6deae10d7c9c36ec6/codex-rs/arg0/src/lib.rs#L20-L24)
- [`arg0_dispatch_or_else()` forwarding both
paths](https://github.com/openai/codex/blob/e355b43d5c2a771f045296a6deae10d7c9c36ec6/codex-rs/arg0/src/lib.rs#L145-L176)
- [zsh-fork escalation using configured wrapper
path](https://github.com/openai/codex/blob/e355b43d5c2a771f045296a6deae10d7c9c36ec6/codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs#L109-L150)

## Testing

- `cargo check -p codex-arg0 -p codex-core -p codex-exec -p codex-tui -p
codex-mcp-server -p codex-app-server`
- `cargo test -p codex-arg0`
- `cargo test -p codex-core tools::runtimes::shell::unix_escalation:: --
--nocapture`

codex-rs/core/src/tools/runtimes/shell/unix_escalation.rs

@@ -106,15 +106,22 @@ pub(super) async fn try_run_zsh_fork(
         justification,
         arg0,
     };
-
+    let main_execve_wrapper_exe = ctx
+        .session
+        .services
+        .main_execve_wrapper_exe
+        .clone()
+        .ok_or_else(|| {
+            ToolError::Rejected(
+                "zsh fork feature enabled, but execve wrapper is not configured".to_string(),
+            )
+        })?;
     let exec_params = ExecParams {
         command: script,
         workdir: req.cwd.to_string_lossy().to_string(),
         timeout_ms: Some(effective_timeout.as_millis() as u64),
         login: Some(login),
     };
-    let execve_wrapper =
-        shell_execve_wrapper().map_err(|err| ToolError::Rejected(format!("{err}")))?;
 
     // Note that Stopwatch starts immediately upon creation, so currently we try
     // to minimize the time between creating the Stopwatch and starting the
@@ -132,8 +139,11 @@ pub(super) async fn try_run_zsh_fork(
         stopwatch: stopwatch.clone(),
     };
 
-    let escalate_server =
-        EscalateServer::new(shell_zsh_path.clone(), execve_wrapper, escalation_policy);
+    let escalate_server = EscalateServer::new(
+        shell_zsh_path.clone(),
+        main_execve_wrapper_exe,
+        escalation_policy,
+    );
 
     let exec_result = escalate_server
         .exec(exec_params, cancel_token, &command_executor)
@@ -342,34 +352,6 @@ impl ShellCommandExecutor for CoreShellCommandExecutor {
     }
 }
 
-// TODO(mbolin): This should be passed down from codex-arg0 like codex_linux_sandbox_exe.
-fn shell_execve_wrapper() -> anyhow::Result<PathBuf> {
-    const EXECVE_WRAPPER: &str = "codex-execve-wrapper";
-
-    if let Some(path) = std::env::var_os("PATH") {
-        for dir in std::env::split_paths(&path) {
-            let candidate = dir.join(EXECVE_WRAPPER);
-            if candidate.is_file() {
-                return Ok(candidate);
-            }
-        }
-    }
-
-    let exe = std::env::current_exe()?;
-    let sibling = exe
-        .parent()
-        .map(|parent| parent.join(EXECVE_WRAPPER))
-        .ok_or_else(|| anyhow::anyhow!("failed to determine codex-execve-wrapper path"))?;
-    if sibling.is_file() {
-        return Ok(sibling);
-    }
-
-    Err(anyhow::anyhow!(
-        "failed to locate {EXECVE_WRAPPER} in PATH or next to current executable ({})",
-        exe.display()
-    ))
-}
-
 #[derive(Debug, Eq, PartialEq)]
 struct ParsedShellCommand {
     script: String,