Support remote credential masking with Zsh shell snapshots (#54432)

## Why

Remote credential masking previously supported only Bash commands without login startup or shell snapshots, leaving Zsh commands with unmasked credentials.

## What changed

- Enable masking for Zsh login commands using shell snapshots on Linux and macOS.
- Capture trusted startup profiles per launch, bind the credential broker to the resulting environment, and replace credentials and supported aliases with placeholders before snapshot replay.
- Preserve explicit environment overrides, credential unsets, and launcher-managed proxy settings during replay.
- Warn and fall back to unmasked startup when a snapshot cannot safely replay credentials; stop execution if protected snapshot restoration fails.

## Testing

Extend remote execution tests for inherited and profile-defined credentials, overrides, destination changes, and unsupported-profile fallback. Add a Zsh scenario snapshot showing a credential placeholder in command output.

GitOrigin-RevId: 83193d6cbc05f3deb0d6d0b9ae80974b353ce900

codex-rs/shell-command/src/shell_snapshot.rs

@@ -10,6 +10,8 @@ mod exports;
 mod literals;
 #[path = "shell_snapshot_render.rs"]
 mod render;
+#[path = "shell_snapshot_restore.rs"]
+mod restore;
 
 pub use capture::CapturedSnapshot;
 pub use capture::CapturedStartupEnvironment;
@@ -19,6 +21,9 @@ pub use capture::snapshot_source_capture_script;
 pub use credentials::PreparedSnapshot;
 pub use credentials::SnapshotCredentialEnvironment;
 pub use credentials::prepare_snapshot_credentials;
+pub use restore::SNAPSHOT_BROKERED_UNSET_ENV_PREFIX;
+pub use restore::SNAPSHOT_BROKERED_VALUE_ENV_PREFIX;
+pub use restore::build_brokered_credential_exports;
 
 use capture::BASH_SH_SNAPSHOT_HEADER;