Honor request PATH in exec-server shell snapshots (#39917)

## What changed

- Apply all per-request environment overrides, including `PATH`, after restoring
  the captured shell environment.
- Remove `runtime_path_prepends` from `ShellSnapshotRequest` and the associated
  PATH replay and deduplication logic.
- Keep the shell snapshot integration test's runtime PATH setup in the command
  being executed.

GitOrigin-RevId: a6f8d2e144bf9977c7434bc58b60ac972f7e0449

codex-rs/exec-server-protocol/src/protocol.rs

@@ -269,9 +269,6 @@ pub struct ShellSnapshotRequest {
     pub scope_id: String,
     /// Executor-native shell used to capture and restore the snapshot.
     pub shell: ShellInfo,
-    /// Runtime-owned PATH entries to replay after restoring profile state.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub runtime_path_prepends: Vec<String>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]