fix(codex): prefer npm/cargo paths over WindowsApps on Windows

[tamish560]

What

On Windows, ResolveCodexBinary now checks known user-install paths (npm codex.cmd/codex.exe, cargo codex.exe) before falling back to exec.LookPath. When exec.LookPath is used as a last resort, paths under WindowsApps are skipped.

Why

On Windows machines with both the WindowsApps packaged Codex and an npm-installed Codex CLI, exec.LookPath("codex.exe") resolves to the WindowsApps executable first. That binary cannot be launched directly by AO (Access denied), so the auth probe fails and the UI incorrectly shows Codex - Needs auth even though the npm Codex CLI is logged in.

Closes #2582

How

1. Reorder the Windows resolution: check known npm/cargo candidate paths first, then fall back to exec.LookPath only if none exist.
2. Add isWindowsAppsPath filter to skip WindowsApps results from exec.LookPath, since those binaries cannot be spawned directly by the daemon.
3. Add TestIsWindowsAppsPath covering forward/back slashes, case sensitivity, and non-WindowsApps paths.

Testing

• TestIsWindowsAppsPath passes on all platforms (pure string matching, no Windows required).
• Existing TestResolveCodexBinaryFindsNVMInstallWhenPathIsSparse still passes (Unix path resolution unchanged).
• The reorder only affects the Windows branch; non-Windows code paths are untouched.

[tamish560]

Closing this as a duplicate of #2583 by @somewherelostt, which was opened two days earlier and addresses the same issue (#2582) with the same approach. Should have checked for existing PRs before opening this one. Apologies for the noise.