Expose originating tool call metadata in command environments

[copyberry]

Expose originating tool call metadata in command environments

Why

Command processes need thread and tool call labels for correlation, without stale values from inherited environments or cached shell snapshots.

What changed

• Export the originating exec_command call ID as CODEX_TOOL_CALL_ID; later write_stdin calls leave it unchanged.
• Apply executor metadata as CODEX_THREAD_ID and CODEX_TOOL_CALL_ID after environment policies, overlays, and snapshot replay. Clear omitted fields when metadata is present; without metadata, preserve thread context and remove the call ID.
• Exclude both IDs from newly captured snapshots and omit the call ID from capture and validation helpers.
• Preserve empty call IDs, omit NUL-containing IDs, and handle case-insensitive environment names on Windows. Document that these labels support correlation, not authorization.

Testing

Add regression coverage for metadata precedence, missing and invalid IDs, snapshot capture and replay, local and remote execution with pipes and TTYs, sandboxed remote execution, and preservation of the originating call ID across later input.

[chatgpt-codex-connector]

Note

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}