Support remote credential masking with Zsh shell snapshots (#54432)

## Why

Remote credential masking previously supported only Bash commands without login startup or shell snapshots, leaving Zsh commands with unmasked credentials.

## What changed

- Enable masking for Zsh login commands using shell snapshots on Linux and macOS.
- Capture trusted startup profiles per launch, bind the credential broker to the resulting environment, and replace credentials and supported aliases with placeholders before snapshot replay.
- Preserve explicit environment overrides, credential unsets, and launcher-managed proxy settings during replay.
- Warn and fall back to unmasked startup when a snapshot cannot safely replay credentials; stop execution if protected snapshot restoration fails.

## Testing

Extend remote execution tests for inherited and profile-defined credentials, overrides, destination changes, and unsupported-profile fallback. Add a Zsh scenario snapshot showing a credential placeholder in command output.

GitOrigin-RevId: 83193d6cbc05f3deb0d6d0b9ae80974b353ce900

codex-rs/shell-command/src/shell_snapshot_credentials.rs

@@ -8,6 +8,7 @@ use super::render;
 use super::render::Export;
 use super::render::Value;
 use super::render::ValuePart;
+use crate::shell_detect::ShellType;
 use std::collections::HashMap;
 
 /// Environment views used to render protected credential references into a shell snapshot.
@@ -106,7 +107,9 @@ pub fn prepare_snapshot_credentials(
             let next_credential = credential_keys
                 .iter()
                 .filter_map(|credential_key| {
-                    let dummy = discovered.get(*credential_key)?;
+                    let dummy = discovered
+                        .get(*credential_key)
+                        .filter(|dummy| !dummy.is_empty())?;
                     let real = real_credential_value(credential_key)?;
                     let allowed_key = allowed_brokered_keys
                         .iter()
@@ -296,11 +299,24 @@ pub fn prepare_snapshot_credentials(
                     return Some(Export::Captured(line));
                 }
                 return Some(Export::Assignment {
-                    declaration,
+                    declaration: if captured.shell_type == ShellType::Zsh
+                        && configured.contains_key(key)
+                    {
+                        format!("export {key}").into()
+                    } else {
+                        declaration.into()
+                    },
                     value: assignment,
                 });
             }
 
+            // Explicit scalar overrides must not inherit captured coercion attributes.
+            if captured.shell_type == ShellType::Zsh
+                && configured.contains_key(key)
+                && matches!(export.value, ExportValue::Plain)
+            {
+                return None;
+            }
             Some(Export::Captured(line))
         })
         .collect::<Vec<_>>();