Propagate executor home directories into sandbox contexts (#41204)

## What changed

- Report the executor's user home in environment metadata.
- Cache the reported home on selected turn environments and include it in
  filesystem sandbox contexts, including `apply_patch` requests.
- Preserve compatibility with executors that do not report a home directory.

## Testing

- Cover local, remote, inherited, serialized, and `apply_patch` sandbox
  contexts.

GitOrigin-RevId: ea65e68e33a80bc9bcfc7c53b1486ab944699470

codex-rs/core/src/tools/runtimes/apply_patch.rs

@@ -100,6 +100,7 @@ impl ApplyPatchRuntime {
             permissions: permissions.into(),
             cwd: Some(attempt.sandbox_cwd.clone()),
             workspace_roots: attempt.workspace_roots.to_vec(),
+            user_home_dir: req.turn_environment.user_home_dir.clone(),
             temporary_directories: None,
             windows_sandbox_level: executor_windows_sandbox_level(
                 attempt.windows_sandbox_level,

codex-rs/core/src/tools/runtimes/apply_patch_tests.rs

@@ -288,7 +288,7 @@ async fn file_system_sandbox_context_respects_sandbox_request() {
     let path = std::env::temp_dir()
         .join("apply-patch-runtime-none.txt")
         .abs();
-    let req = ApplyPatchRequest {
+    let mut req = ApplyPatchRequest {
         turn_environment: test_turn_environment(codex_exec_server::LOCAL_ENVIRONMENT_ID),
         action: ApplyPatchAction::new_add_for_test(
             &PathUri::from_abs_path(&path),
@@ -329,6 +329,8 @@ async fn file_system_sandbox_context_respects_sandbox_request() {
     );
 
     let cwd = PathUri::parse("file:///C:/workspace").expect("Windows workspace URI");
+    let user_home_dir = PathUri::parse("file:///C:/Users/remote").expect("Windows home URI");
+    req.turn_environment.user_home_dir = Some(user_home_dir.clone());
     let permissions = PermissionProfile::workspace_write();
     let attempt = SandboxAttempt {
         sandbox_requested: true,
@@ -345,6 +347,7 @@ async fn file_system_sandbox_context_respects_sandbox_request() {
             permissions: permissions.into(),
             cwd: Some(cwd.clone()),
             workspace_roots: vec![cwd],
+            user_home_dir: Some(user_home_dir),
             temporary_directories: None,
             windows_sandbox_level: WindowsSandboxLevel::RestrictedToken,
             windows_sandbox_private_desktop: false,

codex-rs/core/src/tools/sandboxing.rs

@@ -513,6 +513,7 @@ impl<'a> SandboxAttempt<'a> {
                 permissions: exec_server_permissions.into(),
                 cwd: Some(exec_request.windows_sandbox_policy_cwd.clone()),
                 workspace_roots: self.workspace_roots.to_vec(),
+                user_home_dir: None,
                 temporary_directories: None,
                 windows_sandbox_level: executor_windows_sandbox_level(
                     self.windows_sandbox_level,

codex-rs/core/src/tools/sandboxing_tests.rs

@@ -370,6 +370,7 @@ fn exec_server_env_keeps_command_native_and_carries_sandbox_context() {
             permissions: exec_server_permissions.clone().into(),
             cwd: Some(cwd_uri.clone()),
             workspace_roots: vec![cwd_uri.clone()],
+            user_home_dir: None,
             temporary_directories: None,
             windows_sandbox_level: if cfg!(windows) {
                 codex_protocol::config_types::WindowsSandboxLevel::RestrictedToken