cli: add package path from install context

[bolinfest]

Why

Codex package installs include helper binaries in codex-path, such as the bundled rg. Package-layout launches should add that directory before user commands run, but standalone launches were missing it while npm launches only worked because codex.js had its own legacy PATH rewrite. That made npm and standalone package behavior diverge.

Shell snapshot restoration can also reset PATH after runtime setup. Any package-owned PATH prepend has to be recorded as an explicit runtime override so shells, unified exec, and user-shell commands keep access to codex-path after a snapshot is sourced.

Repro

Before this change, a curl-installed package could contain rg under codex-path but still fail to put it on PATH:

mkdir /tmp/test-codex-curl
curl -fsSL https://chatgpt.com/codex/install.sh \
  | CODEX_HOME=/tmp/test-codex-curl CODEX_NON_INTERACTIVE=1 sh
/tmp/test-codex-curl/packages/standalone/current/bin/codex exec \
  --skip-git-repo-check 'print `which -a rg`'
find /tmp/test-codex-curl -name rg

The which -a rg output omitted the packaged helper even though find showed it under /tmp/test-codex-curl/packages/standalone/releases/.../codex-path/rg.

The npm install path behaved differently only because codex-cli/bin/codex.js had legacy PATH rewriting:

mkdir /tmp/test-codex-npm
cd /tmp/test-codex-npm
npm install @openai/codex
./node_modules/.bin/codex exec --skip-git-repo-check 'print `which -a rg`'

That printed the npm package's vendor/<target>/codex-path/rg first. This PR moves that behavior into Rust-side package launch setup so curl/standalone and npm/bun launches agree without JS rewriting PATH.

What Changed

• codex-rs/arg0 now uses InstallContext::current().package_layout.path_dir to prepend the package helper directory before any threads are created.
• Package helper PATH setup is independent from the temporary arg0 alias setup, so codex-path is still added even if CODEX_HOME tempdir, lock, or symlink setup fails.
• codex-rs/install-context detects the canonical package layout we ship: bin/, codex-resources/, and codex-path/ next to codex-package.json.
• Shell, local unified exec, and user-shell runtimes now record package codex-path prepends in explicit_env_overrides, matching the existing zsh-fork behavior so shell snapshots cannot restore over the package helper path.
• Remote unified exec requests do not receive the local app-server package path overlay.
• codex-cli/bin/codex.js no longer computes or overrides PATH; it only locates the native binary in the canonical package layout and passes npm/bun management metadata.
• Added regression tests for PATH ordering, package layout detection, and shell snapshot preservation of package path prepends.

Verification

• node --check codex-cli/bin/codex.js
• just test -p codex-install-context -p codex-arg0
• just test -p codex-core user_shell_snapshot_preserves_package_path_prepend
• just test -p codex-core tools::runtimes::tests
• just bazel-lock-update
• just bazel-lock-check
• just fix -p codex-install-context -p codex-arg0 -p codex-core

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5d531b0a3e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[viyatb-oai]

A few places where the package PATH can still be lost or broadened unexpectedly.

[viyatb-oai]

The original comments are addressed. I found two remaining cases in the new snapshot-preservation path.

[viyatb-oai]

Nothing blocking from my side. The latest change fixes the snapshot PATH issue by replaying only Codex-owned prepends after snapshot restoration, while preserving explicit PATH overrides and keeping remote unified exec local-path-free.