fix(activity): preserve Windows paths across casing

[sylvesterkaczmarek]

Summary

Preserve live and saved scan activity paths when Windows repository/path casing differs.

Fixes #544.

Reproduction / evidence

Current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba normalizes Windows separators but compares the concrete repository prefix with case-sensitive startsWith().

For example:

scanActivityFromEvent(
  toolEvent("c:\\CODE\\JUICE-SHOP\\routes\\Login.ts"),
  "C:\\code\\juice-shop",
)

The path denotes the same ordinary Windows repository location, but current main returns paths: [].

The same prefix logic is used for saved-session tool calls and absolute paths embedded in shell commands.

Root cause

Path separators were normalized independently of path-comparison semantics. Windows drive and UNC roots therefore passed through POSIX-style case-sensitive prefix matching.

Fix

• normalize the repository root once and detect Windows drive/UNC path shapes;
• compare only concrete Windows repository prefixes case-insensitively;
• keep $CODEX_SECURITY_REPOSITORY placeholder matching case-sensitive;
• slice the relative path from the original normalized value so source-path casing is preserved;
• keep POSIX repository comparisons case-sensitive.

The logic is based on the repository path shape rather than process.platform, so saved/synthetic Windows events remain correct when rendered on another host.

Tests / validation

Added scan-activity-windows-case.test.ts covering:

• live tool events with different drive/directory casing;
• saved-session tool events;
• command path extraction;
• UNC repository roots;
• a POSIX case-sensitivity control.

The branch is based directly on current upstream main at 37bf87a692fc72d41f7312cc48808d699d204fba and is not behind it.

Full repository tests cannot be run in this execution environment because the repository cannot be cloned here. Pushed-head CI remains the authoritative full-suite validation.

Risk

Low. The behavior changes only for Windows-shaped absolute repository prefixes. Relative display casing is preserved and POSIX semantics are unchanged.