Remove the patched zsh shell execution backend (#52160)

## What changed

- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.

## Testing

Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.

GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8

.github/scripts/windows_bazel_test_durations.tsv

@@ -218,8 +218,6 @@
 //codex-rs/sandboxing:sandboxing-unit-tests	74
 //codex-rs/secrets:secrets-unit-tests	57
 //codex-rs/shell-command:shell-command-unit-tests	60
-//codex-rs/shell-escalation:codex-execve-wrapper-bin-unit-tests	62
-//codex-rs/shell-escalation:shell-escalation-unit-tests	60
 //codex-rs/skills:skills-unit-tests	59
 //codex-rs/state:state-unit-tests	242
 //codex-rs/test-binary-support:test-binary-support-unit-tests	48