Honor request PATH in exec-server shell snapshots (#39917)

## What changed

- Apply all per-request environment overrides, including `PATH`, after restoring
  the captured shell environment.
- Remove `runtime_path_prepends` from `ShellSnapshotRequest` and the associated
  PATH replay and deduplication logic.
- Keep the shell snapshot integration test's runtime PATH setup in the command
  being executed.

GitOrigin-RevId: a6f8d2e144bf9977c7434bc58b60ac972f7e0449

codex-rs/exec-server/src/shell_snapshot.rs

@@ -132,15 +132,9 @@ impl ShellSnapshotCache {
             return Ok(());
         };
 
-        let restore_snapshot_path = snapshot.environment.contains_key("PATH")
-            && params
-                .env_policy
-                .as_ref()
-                .is_none_or(|policy| !policy.r#set.contains_key("PATH"));
         let request_overrides = params
             .env
             .iter()
-            .filter(|(name, _)| name.as_str() != "PATH" || !restore_snapshot_path)
             .map(|(name, value)| {
                 (
                     name.clone(),
@@ -155,20 +149,6 @@ impl ShellSnapshotCache {
                 .map(|(name, value)| (name.clone(), value.clone())),
         );
         prepared.env.extend(request_overrides);
-        if restore_snapshot_path && let Some(path) = prepared.env.get_mut("PATH") {
-            for entry in &request.runtime_path_prepends {
-                if entry.is_empty() {
-                    continue;
-                }
-                *path = std::iter::once(entry.as_str())
-                    .chain(
-                        path.split(':')
-                            .filter(|existing| !existing.is_empty() && *existing != entry),
-                    )
-                    .collect::<Vec<_>>()
-                    .join(":");
-            }
-        }
         prepared
             .env
             .retain(|name, _| !shell_environment::is_non_inheritable_env_var(name));