Preserve SystemRoot for Windows filesystem sandbox helpers (#56468)

## Why

MXC needs `SystemRoot` to create the sandboxed filesystem helper process.

## What changed

Allow `SystemRoot` through the Windows helper environment filter using case-insensitive matching.

## Testing

Extend the environment-filter test to cover mixed-case `SystemRoot` and the Windows sandbox write-policy test to verify that writes to an allowed directory succeed.

GitOrigin-RevId: 0979b0c83eff245ee380fae9d7cf05dcc739265f

codex-rs/exec-server/src/fs_sandbox.rs

@@ -373,10 +373,10 @@ fn helper_env_key_is_allowed(key: &str) -> bool {
         // CoreFoundation consults this before falling back to user lookup during helper startup.
         || (cfg!(target_os = "macos") && key == "__CF_USER_TEXT_ENCODING")
         || bazel_bwrap_env_key_is_allowed(key)
-        // MXC needs SystemDrive to resolve platform directories and LOCALAPPDATA
-        // to create the sandboxed helper process.
+        // MXC needs SystemDrive to resolve platform directories, and SystemRoot and
+        // LOCALAPPDATA to create the sandboxed helper process.
         || (cfg!(windows)
-            && ["PATH", "SystemDrive", "LOCALAPPDATA"]
+            && ["PATH", "SystemDrive", "SystemRoot", "LOCALAPPDATA"]
                 .iter()
                 .any(|allowed| key.eq_ignore_ascii_case(allowed)))
 }
@@ -716,6 +716,7 @@ mod tests {
                 ("Path", r"C:\Windows\System32"),
                 ("LocalAppData", r"C:\Users\test\AppData\Local"),
                 ("SystemDrive", "C:"),
+                ("systemROOT", r"C:\Windows"),
                 ("PATH_INJECTION", "bad"),
                 ("OPENAI_API_KEY", "secret"),
             ]
@@ -731,6 +732,7 @@ mod tests {
                     r"C:\Users\test\AppData\Local".to_string()
                 ),
                 ("SystemDrive".to_string(), "C:".to_string()),
+                ("systemROOT".to_string(), r"C:\Windows".to_string()),
             ])
         );
     }

codex-rs/exec-server/tests/file_system_windows.rs

@@ -447,6 +447,19 @@ async fn file_system_remote_fs_helper_respects_windows_sandbox_write_policy(
         "sandboxed fs helper must not create blocked file after error: {error}"
     );
 
+    let mut writable_sandbox = workspace_write_sandbox(readonly_dir.clone());
+    writable_sandbox.windows_sandbox_selection = sandbox.windows_sandbox_selection;
+    let allowed_file = readonly_dir.join("allowed.txt");
+    file_system
+        .write_file(
+            &PathUri::from_host_native_path(&allowed_file)?,
+            b"allowed".to_vec(),
+            WriteFileOptions::default(),
+            Some(&writable_sandbox),
+        )
+        .await?;
+    assert_eq!(std::fs::read(&allowed_file)?, b"allowed");
+
     Ok(())
 }