feat(state): add managed worktree path key codec

[andrei-hasna]

Summary

• Stage a private, filesystem-free managed-worktree path key codec as a test-only specification; production persistence and admission integration remain deferred.
• Preserve raw Unix bytes and Windows UTF-16 units while normalizing separators and dot segments conservatively.
• Preserve every non-root .. component because a symlink can make link/../run-b differ from run-b; discard a parent only at an established POSIX, drive, root-relative, or UNC-share root.
• Keep Windows verbatim/device namespaces distinct; preserve case and Unicode spelling because filesystem-specific alias policy is deferred.
• Distinguish POSIX exactly-two-leading-slash paths and use unambiguous u64 length framing.

Validation

• focused path-key tests: 9 passed
• just test -p codex-state: 325 passed
• just clippy -p codex-state -- -D warnings: passed
• Windows target x86_64-pc-windows-gnu is installed; cargo check -p codex-state --target x86_64-pc-windows-gnu is host-blocked before codex-state by the missing x86_64-w64-mingw32-gcc required by existing aws-lc-sys and ring native builds
• staged and exact-range Gitleaks scans: clean
• final just fix -p codex-state, then just fmt; no tests afterward

Scope

No dependency or lock changes. No migrations, startup backfill, StateRuntime hooks, DB key writes, admission enforcement, app-server, workflow, or background-agent changes.

Follow-up

Filesystem-policy-aware alias checks, codec persistence, migration, and admission enforcement remain separate dependent stages. Fresh parent adversarial reviews and exact-head GitHub CI are required before merge.

[andrei-hasna]

CI repair: replaced only the Unicode NFC/NFD fixture spellings that triggered Codespell, while preserving the normalization assertions.

• Head: 46be9ee
• Tree: 2253498345368a6d955729a6e2b768031d9159cb
• Focused validation: just test-fast -p codex-state path_keys — 7/7 passed
• Finalization: just fix -p codex-state, then just fmt (no tests afterward)
• Staged and exact-range secret scans: clean; git diff --check: clean
• Codespell CI: https://github.com/hasna/codewith/actions/runs/29697623328 — success
• Other exact-head CI still running: Rust CI 29697623306, codewith-cli 29697623302, cargo-deny 29697623305, SDK 29697623300, v8-canary 29697623354, Bazel 29697623296

The native goal remains active pending parent-provided external review and exact-head CI.