Preserve SystemRoot for Windows filesystem sandbox helpers (#56468)

## Why

MXC needs `SystemRoot` to create the sandboxed filesystem helper process.

## What changed

Allow `SystemRoot` through the Windows helper environment filter using case-insensitive matching.

## Testing

Extend the environment-filter test to cover mixed-case `SystemRoot` and the Windows sandbox write-policy test to verify that writes to an allowed directory succeed.

GitOrigin-RevId: 0979b0c83eff245ee380fae9d7cf05dcc739265f

codex-rs/exec-server/tests/file_system_windows.rs

@@ -447,6 +447,19 @@ async fn file_system_remote_fs_helper_respects_windows_sandbox_write_policy(
         "sandboxed fs helper must not create blocked file after error: {error}"
     );
 
+    let mut writable_sandbox = workspace_write_sandbox(readonly_dir.clone());
+    writable_sandbox.windows_sandbox_selection = sandbox.windows_sandbox_selection;
+    let allowed_file = readonly_dir.join("allowed.txt");
+    file_system
+        .write_file(
+            &PathUri::from_host_native_path(&allowed_file)?,
+            b"allowed".to_vec(),
+            WriteFileOptions::default(),
+            Some(&writable_sandbox),
+        )
+        .await?;
+    assert_eq!(std::fs::read(&allowed_file)?, b"allowed");
+
     Ok(())
 }