[codex] exec-server honors remote environment cwd and shell (#28122)

## Why

Next slice needed to make progress on the `remote_env_windows` test is
to support passing a Windows cwd for the remote environment and using
that environment's native shell. This lets the test run a real Windows
process instead of only recording an early path or shell mismatch.

## What

- change `TurnEnvironmentSelection.cwd` from `AbsolutePathBuf` to
`PathUri`
- convert local cwd values to URIs when constructing selections
- preserve a remote primary cwd instead of replacing it with the local
legacy fallback
- prefer the selected environment's discovered shell for unified exec,
falling back to the session shell when unavailable
- convert back to a host-native absolute path at current native-only
consumer boundaries
- reject or deny unsupported foreign cwd values at the existing
request-permissions boundary, with TODOs for its future migration
- extend the hermetic Wine test to execute Windows PowerShell in
`C:\windows` and verify successful process completion
- record the current app-server rejection against the same Wine-backed
remote Windows fixture when its cwd is supplied as a native Windows path

codex-rs/exec-server/testing/BUILD.bazel

@@ -1,4 +1,20 @@
-load("@rules_rust//rust:defs.bzl", "rust_binary")
+load("@rules_rust//rust:defs.bzl", "rust_binary", "rust_library")
+
+rust_library(
+    name = "wine-exec-server-test-support",
+    testonly = True,
+    srcs = ["wine_exec_server.rs"],
+    crate_name = "wine_exec_server_test_support",
+    crate_root = "wine_exec_server.rs",
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//codex-rs/core/tests/remote_env_windows:__pkg__"],
+    deps = [
+        "//bazel/rules/testing/wine:wine_test_support",
+        "//codex-rs/utils/cargo-bin",
+        "@crates//:anyhow",
+        "@crates//:tokio",
+    ],
+)
 
 rust_binary(
     name = "windows-exec-server",

codex-rs/exec-server/testing/wine_exec_server.rs

@@ -0,0 +1,43 @@
+//! Test support for running the Windows exec-server under Wine.
+
+use std::future::Future;
+
+use anyhow::Context;
+use anyhow::Result;
+use tokio::io::AsyncBufReadExt;
+use tokio::io::BufReader;
+use wine_test_support::WineTestCommand;
+
+/// Runs the Windows exec-server under Wine for the duration of a scoped operation.
+pub struct WineExecServer;
+
+impl WineExecServer {
+    /// Starts the server, passes its WebSocket URL to `operation`, and tears it down afterward.
+    pub async fn scope<T, F, Fut>(self, operation: F) -> Result<T>
+    where
+        F: FnOnce(String) -> Fut,
+        Fut: Future<Output = Result<T>>,
+    {
+        let executable = codex_utils_cargo_bin::cargo_bin("wine-windows-exec-server")?;
+        let mut exec_server = WineTestCommand::new(executable)
+            .env("CODEX_HOME", r"C:\codex-home")
+            .spawn()?;
+        let stdout = exec_server.take_stdout();
+
+        exec_server
+            .scope(async move {
+                let mut lines = BufReader::new(stdout).lines();
+                let exec_server_url = loop {
+                    let line = lines
+                        .next_line()
+                        .await?
+                        .context("Wine exec-server exited before reporting its URL")?;
+                    if line.starts_with("ws://") {
+                        break line;
+                    }
+                };
+                operation(exec_server_url).await
+            })
+            .await
+    }
+}