fix(diagnostics): preserve home guards in isolated child environments

[luvs01]

Summary

• Capture an absolute original home before clearing the diagnostic child's environment, then arm OCX_TEST_HOME_GUARD and preserve OCX_REAL_HOME before assigning synthetic fixture homes.
• Share the setup with the Rust-driven Bun contracts. Verify that protected OpenCodex/Codex paths remain refused, fixture paths remain usable, and relative protected-home inputs fail before spawning.
• Carry the unique change from source commit 973abbc9fc9fbf80ff9473849e9b607189e81331 onto current dev 6da2774369aa32552e318e333902499683d053bc. This is diagnostic isolation; no installed application or account configuration is changed.

Verification

• The four code/test files are byte-identical to the source revision. The README contains the same added paragraph at a different location so it can coexist with the pending process-isolation note in fix(test): isolate diagnostic servers from live Codex restart #7018; a three-way README merge retains both notes without conflicts. That PR's implementation was not modified or included.
• Source-revision Catalog async contracts CI actually ran formatting, Clippy and the Rust/Bun module contracts on Linux, macOS and Windows. The Windows log confirms 16 passed, 0 failed, including the protected-home contracts. These are source-revision results, not CI for this new commit.
• Local bun run typecheck, bun run structure:check, and git diff --check passed. bun run privacy:scan passed for materialized tracked files, including all changed files; the checkout is sparse.
• Cargo/Rust is not available on this local machine, so the unchanged Rust tests were not recompiled locally and no large toolchain was installed just to duplicate the successful source-revision jobs. The Windows liveness controller was not launched against a live application.
• The full repository suite and new-head CI remain outstanding. Keep this PR in Draft for CI and maintainer/security review.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 31 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 226bfd6a-1e07-44e6-ab7d-cbfdd5e378c3

📥 Commits

Reviewing files that changed from the base of the PR and between e6d7e56 and fa70acb.

📒 Files selected for processing (5)

• scripts/diagnostics/windows-version-control/README.md
• scripts/diagnostics/windows-version-control/src/control.rs
• scripts/diagnostics/windows-version-control/src/fixture_env.rs
• scripts/diagnostics/windows-version-control/src/main.rs
• scripts/diagnostics/windows-version-control/tests/async_contracts.test.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T07:35:27.835028Z	fa70acb	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[lidge-jun]

Thanks @luvs01! Reviewed: the diagnostic controller now captures an absolute original home before env_clear() and arms OCX_TEST_HOME_GUARD/OCX_REAL_HOME, so the fixture child keeps refusing the real OpenCodex/Codex homes; the new contracts cover both refusal and the relative-path error. Diagnostics-only, no production change.

Maintainer integration into dev under MAINTAINERS.md (admin dev-only PR bypass). Exact-head CI evidence: all checks green on fa70acb48e04aeb5d23308872f75f682ff0c9962 (branch updated onto #7018; test 1–4/4, Catalog async contracts on ubuntu/macos/windows, enforce-target). The only later dev commit (#7029) touches disjoint files.