fix: add shell fallback paths for pwsh/powershell that work on GitHub Actions Windows runners

[bolinfest]

Recently, I merged a number of PRs to increase startup timeouts for scripts that ran under PowerShell, but in the failure for suite::codex_tool::test_shell_command_approval_triggers_elicitation, I found this in the error logs when running on Bazel with BuildBuddy:

[mcp stderr] 2026-04-02T19:54:10.758951Z ERROR codex_core::tools::router: error=Exit code: 1
[mcp stderr] Wall time: 0.2 seconds
[mcp stderr] Output:
[mcp stderr] 'New-Item' is not recognized as an internal or external command,
[mcp stderr] operable program or batch file.
[mcp stderr] 

This error implies that the command was run under cmd.exe instead of pwsh.exe. Under GitHub Actions, I suspect that the %PATH% that is passed to our Bazel builder is scrubbed such that our tests cannot find PowerShell where GitHub installs it. Having these explicit fallback paths should help.

While we could enable these only for tests, I don't see any harm in keeping them in production, as well.