Bind unified exec approvals to shell executables (#39311)

## Why

An unfamiliar executable can ignore its arguments, so trust in an apparent
inner command must not implicitly trust the executable that runs it.

## What changed

- Evaluate unfamiliar shell executables alongside their parsed commands when
  determining unified exec approval requirements. Inner commands can add
  restrictions, but cannot grant trust to the executable.
- Include the executable in reusable approval keys so approval for one custom
  shell does not apply to another.
- Parse literal PowerShell scripts without launching the requested executable,
  preserving command policy checks before approval.

## Testing

Add cross-platform coverage for spoofed shell paths, allowed and forbidden
inner commands, explicit custom-shell approval, and session approval isolation.

GitOrigin-RevId: 0dd2c7e9a2ac30965ef5fe5de1a8d2968bb5f9d0

codex-rs/shell-command/src/command_safety/mod.rs

@@ -1,6 +1,4 @@
 mod powershell_parser;
-// Production safety and exec-policy callers migrate to this lowerer in a follow-up.
-#[allow(dead_code)]
 mod powershell_tree_sitter;
 
 pub mod is_dangerous_command;
@@ -8,3 +6,4 @@ pub mod is_safe_command;
 #[cfg(windows)]
 pub(crate) mod windows_safe_commands;
 pub(crate) use powershell_parser::try_parse_powershell_ast_commands;
+pub(crate) use powershell_tree_sitter::try_parse_powershell_commands;

codex-rs/shell-command/src/command_safety/powershell_tree_sitter.rs

@@ -10,7 +10,7 @@ use tree_sitter::Parser;
 /// Unknown syntax, parse recovery, and dynamic expressions fail closed instead of being guessed
 /// at. The accepted CST shapes intentionally cover only common literal command forms; rare
 /// PowerShell syntax and value-conversion cases stay opaque.
-pub(super) fn try_parse_powershell_commands(script: &str) -> Option<Vec<Vec<String>>> {
+pub(crate) fn try_parse_powershell_commands(script: &str) -> Option<Vec<Vec<String>>> {
     lower_with_tree_sitter(script).ok()
 }