Keep canonical project trust keys first so persisted trusted project entries keep their existing lookup shape while still matching symlink aliases.
Use the per-thread derived config for app-server thread-initialized analytics and isolate app-server integration subprocesses from host managed config by default.
Co-authored-by: Codex <noreply@openai.com>