fix: normalize Windows configuration paths

[faizan-oai]

Summary

Severity: P1–P2. Windows path spelling, environment-key casing, home-relative values, and machine-wide configuration could cause valid Codex Security settings to be missed or resolved against the wrong location. This makes those inputs resolve consistently while preserving existing configuration precedence.

Changes

• Expand home-relative paths at CLI, runtime, comparison, and Deep Scan configuration boundaries.
• Match Windows environment keys and equivalent filesystem aliases using Windows semantics.
• Load machine-wide preflight configuration from ProgramData and recognize aliased project trust paths.
• Add focused coverage for path spelling, casing, aliases, and configured Python selection.

Testing

• pnpm run format — passed.
• pnpm run types — passed.
• pnpm run build — passed.
• Focused Windows configuration-path regressions — 10 passed.
• git diff --check origin/main...HEAD — passed.

Risk and rollout

The changes are limited to configuration discovery and path normalization. Existing precedence remains unchanged, and non-Windows path behavior is preserved apart from explicit home expansion where the CLI already accepts a path. No migration or rollout step is required.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[mldangelo-oai]

Reviewed 6c185159fefe for correctness and simplification. One optional test simplification. The production changes preserve the intended configuration precedence.

This is a non-blocking review. I did not run the full SDK suite or native Windows tests locally.

[mldangelo-oai]

Rechecked 6c18515. The earlier simplification suggestions remain non-blocking. Approving the reviewed head.

[mldangelo-oai]

Re-reviewed 020c2b3, including the test-only update since the earlier approval. The previous review thread is addressed, and I found no new blocking issue.

CI is green on this head, including Windows, but the branch still conflicts with main in sdk/typescript/src/cli.ts. The resolution should retain both resolveCliPath(directory, input) and lstat(path, { bigint: true }). A fresh approval should be attached to the conflict-free replacement head after its checks pass.

Local validation: the diff whitespace check and focused Python preflight smoke checks passed. I did not run the full SDK suite or native Windows tests locally.