fix: resolve rescue plugin root without environment

[JanFrehar]

Summary

• resolve codex:codex-rescue through the active codex@openai-codex install registry when CLAUDE_PLUGIN_ROOT is absent
• keep the valid environment fast path, fail closed on malformed or ambiguous registry state, and preserve argv/stdout/exit behavior
• make the runtime skill canonical for the subagent bootstrap and cover both resume and task paths behaviorally

Verification

• node --test tests/commands.test.mjs — 9/9 passed
• actual unset-root smoke against the installed registry — exit 0; task-resume-candidate returned available: false
• git diff --check — passed
• npm test — all 77 observed tests passed, but the existing long-running tests/runtime.test.mjs process exceeded both 120 s and 300 s command limits before suite completion; no assertion failure was emitted

Review

• final correctness/completeness review: PASS
• final security review: PASS

Related: LIVEROCERANO/cerbot#6004

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c692458d0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Invoke a portable shell in the resolver test

On native Windows, spawnSync("/bin/bash", ...) fails with ENOENT because /bin/bash is not a valid Windows executable path, so this new test fails before exercising the resolver. The repository explicitly supports Windows in tests/helpers.mjs and its runtime tests; execute the extracted Node snippet directly or resolve an available shell instead of hard-coding this Unix path.

Useful? React with 👍 / 👎.