fix: fail closed on unusable Codex auth during sandbox auth merge

When reusing a Codex sandbox, the workspace-restore step now performs
an auth-merge check before adopting the sandbox's auth.json. The merge
fails closed when:

- host or sandbox Codex auth is unusable (missing token or account)
- the subscription payload shapes differ between host and sandbox
- subscription account identities do not match

Additional hardening: node absence on PATH during the embedded decision
script now exits non-zero instead of silently falling through. Co-change
comments link parseAuth (the embedded script) to hasUsableAuthPayload
(codex-home.ts) so a future auth-format change cannot silently diverge
between the two implementations.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

scripts/dev-runner-paths.mjs

@@ -0,0 +1,43 @@
+const testDirectoryNames = new Set([
+  "__tests__",
+  "_tests",
+  "test",
+  "tests",
+]);
+
+const ignoredTestConfigBasenames = new Set([
+  "jest.config.cjs",
+  "jest.config.js",
+  "jest.config.mjs",
+  "jest.config.ts",
+  "playwright.config.ts",
+  "vitest.config.ts",
+]);
+
+const nodeDiagnosticReportPattern = /^report\.\d{8}\.\d{6}\.\d+\.\d+\.\d+\.json$/i;
+
+export function shouldTrackDevServerPath(relativePath) {
+  const normalizedPath = String(relativePath).replaceAll("\\", "/").replace(/^\.\/+/, "");
+  if (normalizedPath.length === 0) return false;
+
+  const segments = normalizedPath.split("/");
+  const basename = segments.at(-1) ?? normalizedPath;
+
+  if (nodeDiagnosticReportPattern.test(basename)) {
+    return false;
+  }
+  if (segments.includes(".paperclip")) {
+    return false;
+  }
+  if (ignoredTestConfigBasenames.has(basename)) {
+    return false;
+  }
+  if (segments.some((segment) => testDirectoryNames.has(segment))) {
+    return false;
+  }
+  if (/\.(test|spec)\.[^/]+$/i.test(basename)) {
+    return false;
+  }
+
+  return true;
+}