fix: harden arg0 helper PATH handling

[viyatb-oai]

Motivation

• Avoid placing PATH entries under the system temp directory by creating the helper directory under CODEX_HOME instead of std::env::temp_dir().
• Fail fast on unsafe configuration by rejecting CODEX_HOME values that live under the system temp root to prevent writable PATH entries.

Testing

• Ran just fmt, which completed with a non-blocking imports_granularity warning.
• Ran just fix -p codex-arg0 (Clippy fixes) which completed successfully.
• Ran cargo test -p codex-arg0 and the test run completed successfully.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[viyatb-oai]

I have read the CLA Document and I hereby sign the CLA

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 062b2cdc8b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[bolinfest]

It looks like command_execution_notifications_include_process_id failed on both Linux builds.