Proposal: Add [shell] default_login config to fix PATH clobbering in curated environments

[gvenugo3]

Related issue: #8922

I've been looking into this and have a fix ready. Here's the approach:

Root cause: ShellCommandHandler::base_command() in codex-rs/core/src/tools/handlers/shell.rs hardcodes login.unwrap_or(true), so when no explicit login is passed by the tool call, it always uses a login shell (bash -lc). This re-sources startup scripts and clobbers the inherited PATH, even when shell_environment_policy.inherit = "all" is set.

Fix: Add a [shell] config section with a default_login option:

[shell]
default_login = false

Rules:

• Defaults to true when absent (no behavior change for existing users)
• Per-invocation login param on the tool call always takes precedence
• Threaded through ConfigToml -> Config -> TurnContext -> ShellCommandHandler