Remove the patched zsh shell execution backend (#52160)

## What changed

- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.

## Testing

Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.

GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8

codex-rs/shell-command/src/shell_snapshot_exports.rs

@@ -21,7 +21,7 @@ pub(super) fn script(shell_type: ShellType) -> String {
         ShellType::Zsh => {
             r#"(
   unsetopt rcquotes
-  # The bundled Zsh does not include the zsh/parameter module.
+  # Some Zsh builds do not include the zsh/parameter module.
   for __codex_snapshot_export_name in ${(f)"$(typeset +x)"}; do
     case "$__codex_snapshot_export_name" in
       ""|[0-9]*|*[!A-Za-z0-9_]*|PWD|OLDPWD) continue ;;