codex: session_meta raw-field fast path is depth-agnostic for name/cwd/originator/session_id too #1045

Follow-up from the #1040 review. #1040 fixes model by switching session_meta to the depth-1-only getRawPayloadFieldWindow scan (the depth-agnostic getRawJsonStringField could match base_instructions.provenance.model). The same depth-agnostic scan still applies to session_meta's other raw fields — cwd, name, originator, session_id — so a nested field with the same key (e.g. dynamic_tools[].name) could shadow the top-level one. Harmless today (payload.name is only consumed for function_call/custom_tool_call), but it's the same latent class; the fast path for session_meta should read all its fields depth-1 for consistency. Add a fixture with a nested same-name key.