test(windows): make canonical plugin path fixtures portable

[faizan-oai]

Summary

Fix three reproducible failures in the shared Python contract tests when run natively on Windows. These are test-fixture portability defects, not demonstrated failures of the installed CLI.

Changes

• Compare the UTF-8 Git repository-root result as a Path, so Git's forward slashes and native Windows separators identify the same fixture. Keep both cp932 and cp949 decoding cases.
• Set synthetic USERPROFILE alongside HOME in the legacy tilde-scope fixture, matching Python's Windows home expansion.
• Change only the two existing test files. Production behavior, workflows, dependencies, and test skips are unchanged.

Testing

• Before the fix, all three cases failed on an unmodified source snapshot of main 9bd256a; the two relevant scripts and both tests were checked against that commit's Git blobs.
• Native Windows, Python 3.12.13 / pytest 9.0.3: python -m pytest plugins/codex-security/tests/test_workbench_target.py plugins/codex-security/tests/test_generate_rank_input.py -v — 70 passed, 0 failed, 0 skipped, 78.43 seconds. JUnit output confirms the same totals.
• git diff --check: passed. No Python formatter is configured for these files; the existing style is preserved.
• An initial two-file run placed temporary non-Git fixtures inside an ignored checkout directory and produced 67 passes / 3 failures. The same tests passed after moving only their temporary directories outside Git ancestry; no ignore rules, assertions, or skips changed between those runs. Initial logs are retained separately.
• Cross-platform CI remains required. The existing canonical Python CI job runs on Ubuntu, so the native Windows run above supplies the additional platform check.

Risk and rollout

Test-only change with no runtime or public CLI changes. Unicode decoding and legacy tilde behavior remain asserted on both platforms. No extra dependencies, arbitrary limits, or platform exclusions are introduced.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-27T19:57:19.728441Z	34d3545	Manual request
🔒 Security Review	✅ Completed 2026-08-27T19:55:26.802161Z	34d3545	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[faizan-oai]

@codex review the current head 34d35451f6149b4caa0b63599dcfee2cea4e64e7.

This changes only two existing Python fixtures: path comparison and synthetic home selection. All three Windows failures reproduced on unmodified main; all 70 tests in the affected files pass natively after the correction. Production behavior, workflows, and test skips are unchanged.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: 34d35451f6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".