fix(windows): honor dedupe environment settings

[faizan-oai]

Summary

The deduplication review runner copies the environment into a plain object, losing Windows' case-insensitive lookup behavior. Differently cased API-key and home-directory settings then stop working as intended. An empty primary key also hides a valid alternate key, and empty home settings should use the existing default directories.

Changes

• Reuse the existing platform-aware environment lookup for both supported API-key names and configured private directories.
• Select the first nonblank API key while preserving its original value. Treat exactly empty home-directory settings as unset.
• Extend the existing transport tests with Windows casing, alternate-key fallback and emitted-directory-policy regressions. Assert the exact synthetic login key.
• Keep Windows sandbox selection identical to main. The initial backend-selection change has been withdrawn; configured-backend compatibility remains separate work.

Testing

• Build, ESLint and formatting checks passed on Windows.
• Focused codex-review and scan-comparison suites: 37 passed, 1 existing Windows skip, 0 failed; 178 assertions, seed 1266991936.
• Three compiled-runner controls and three native pre-turn controls passed for empty, whitespace-only and differently cased primary keys. They verified the exact fallback key, ephemeral local account state, unchanged synthetic configuration and child cleanup.
• Empty-home coverage uses an isolated mock-only test; native controls use nonempty synthetic homes. No provider request, model turn, native tool, sandbox backend or elevated setup was exercised.
• The initial PR head had one Windows Node 22 login-readiness CI failure. That head's same-seed local Node 22 replay of the complete API test file passed 137/137; the remote cause remains unclassified. No test timeout or CI policy was changed. CI must validate the revised head.

Risk and rollout

Small caller-level environment changes; the shared helper retains exact-key precedence and case-sensitive behavior on other platforms. Nonempty path values are preserved. No new CLI surface, default sandbox change, migration or release step is introduced. These focused checks do not establish full model-backed deduplication or sandbox enforcement.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-28T01:36:22.056864Z	37efa95	Manual request
🔒 Security Review	✅ Completed 2026-08-28T01:35:14.821244Z	37efa95	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[faizan-oai]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ba42078092

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[faizan-oai]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 37efa95e6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".