Derive remote exec env on the exec-server

Add an exec-server env policy contract and send only the env overlay needed for runtime/sandbox transforms when Core starts remote unified-exec processes. Keep local process startup on the existing exact-env path, and share the shell-environment-policy builder from codex-config so the executor can apply the same inherit/filter/set/include rules against its own process environment.

Co-authored-by: Codex <noreply@openai.com>

codex-rs/exec-server/src/server/handler/tests.rs

@@ -26,6 +26,7 @@ fn exec_params(process_id: &str) -> ExecParams {
             "sleep 0.1".to_string(),
         ],
         cwd: std::env::current_dir().expect("cwd"),
+        env_policy: None,
         env,
         tty: false,
         arg0: None,