[codex] Avoid PowerShell safety parsing off Windows

[adrian-openai]

Summary

This fixes BUGB-17567 by preventing non-Windows command safety classification from invoking the Windows PowerShell safelist/parser path.

Previously, is_known_safe_command called the Windows PowerShell classifier on every platform. That classifier recognizes pwsh/powershell by basename and delegates script parsing to the PowerShell AST parser. The parser starts the supplied executable, so on macOS/Linux a repository-controlled pwsh path could execute during safety parsing before the normal sandboxed command execution path.

The change gates the Windows PowerShell classifier and module behind #[cfg(windows)]. On macOS/Linux, PowerShell-looking commands are no longer auto-approved by the Windows classifier and instead fall through to the normal non-Windows safe-command logic.

Validation

• /private/tmp/codex-tools/bin/just fmt
• PATH=/private/tmp/codex-tools/bin:$PATH /private/tmp/codex-tools/bin/just test -p codex-shell-command

The focused test run passed 135 tests with 0 skipped and completed the crate bench-smoke step.

Notes

This PR is scoped to the BUGB-17567 macOS/Linux path. Windows still uses the PowerShell classifier; a separate hardening follow-up should ensure Windows safety parsing only executes a trusted PowerShell parser binary and does not spawn the command's argv[0] when that path may be repository-controlled.