Honor per-environment shell variable policies (#38902)

## What changed

- Carry `ShellEnvironmentPolicy` in each resolved `EnvironmentConfig` and use
  the selected turn environment's policy for shell commands, user shell tasks,
  and unified exec.
- Infer the policy from the thread configuration when an environment does not
  provide its own resolved configuration.
- Redact the policy from `EnvironmentConfig` debug output because it can contain
  explicit environment variable values.

## Testing

- Verify shell handlers and unified exec filter inherited variables according
  to the selected environment while preserving its explicit overrides.

GitOrigin-RevId: 9f6a52aa4af60e5f17251a0e1b11e1926b779055

codex-rs/core/src/session/environment.rs

@@ -109,7 +109,7 @@ impl Session {
         self.mark_mcp_runtime_dirty();
         self.services.turn_environments.update_selections(
             &environments,
-            &state.session_configuration.turn_environment_config(),
+            &state.session_configuration.inferred_environment_config(),
         );
         Ok(())
     }