Expand MCP tool catalog cache regression coverage (#33308)

## Why

Cached MCP tool catalogs must not substitute stale session state for the live
server connection.

## What changed

- Verify `mcpServerStatus/list` waits for replacement stdio server metadata
  before combining it with cached tools.
- Verify configurations with remotely sourced environment variables bypass the
  tool catalog cache.
- Assert that calls made from cached definitions return output from the live
  replacement process.
- Make the stdio test server available to Windows Bazel integration tests.

GitOrigin-RevId: 0e518cd46f0d89af28e3a4e256023b5872e6e2fb

codex-rs/codex-mcp/src/connection_manager_tests.rs

@@ -19,6 +19,7 @@ use crate::tools::normalize_tools_for_model_with_prefix;
 use codex_config::AppToolApproval;
 use codex_config::Constrained;
 use codex_config::McpServerConfig;
+use codex_config::McpServerEnvVar;
 use codex_config::McpServerToolConfig;
 use codex_config::types::AuthKeyringBackendKind;
 use codex_config::types::OAuthCredentialsStoreMode;
@@ -816,6 +817,36 @@ async fn tool_catalog_cache_sanitizes_tools_and_tracks_environment_generation()
     assert!(!first_context.has_tools());
 }
 
+#[test]
+fn tool_catalog_cache_bypasses_remote_sourced_environment_variables() {
+    let cache = McpToolCatalogCache::default();
+    let runtime_context = McpRuntimeContext::new(
+        Arc::new(EnvironmentManager::without_environments()),
+        PathBuf::from("/tmp"),
+    );
+    let config: McpServerConfig = serde_json::from_value(serde_json::json!({
+        "command": "docs-mcp",
+        "env_vars": [McpServerEnvVar::Config {
+            name: "DOCS_TOKEN".to_string(),
+            source: Some("remote".to_string()),
+        }],
+    }))
+    .expect("MCP config");
+
+    assert!(
+        cache
+            .context(
+                "docs",
+                &config,
+                &runtime_context,
+                /*resolved_environment*/ None,
+                &ElicitationCapability::default(),
+                /*supports_openai_form_elicitation*/ false,
+            )
+            .is_none()
+    );
+}
+
 #[tokio::test]
 async fn list_available_server_infos_uses_cache_while_client_is_pending() {
     let pending_client = futures::future::pending::<Result<ManagedClient, StartupOutcomeError>>()