Windows: `shell_command` fails during PowerShell initialization with `Win32Exception (126)`, while manual `pwsh` / `powershell.exe` commands work

What version of the Codex App are you using (From “About Codex” dialog)?

Codex version: [fill in]

What subscription do you have?

plus

What platform is your computer?

OS: Windows 11

What issue are you seeing?

Title:
Windows: shell_command fails during PowerShell initialization with Win32Exception (126), while manual pwsh / powershell.exe commands work

Body:

Summary

On Windows, Codex Desktop can attach to the thread terminal successfully, but every shell_command call fails before the command actually runs.

This happens both inside the sandbox and outside the sandbox.

The failure occurs during PowerShell initialization, even for a minimal command like:

cmd /c echo TERMINAL_OK


### What steps can reproduce the bug?

Process terminated.
The type initializer for 'System.Management.Automation.Runspaces.InitialSessionState' threw an exception.
   at System.Environment.FailFast(System.Runtime.CompilerServices.StackCrawlMarkHandle, System.String, System.Runtime.CompilerServices.ObjectHandleOnStack, System.String)
   at System.Environment.FailFast(System.Threading.StackCrawlMark ByRef, System.String, System.Exception, System.String)
   at System.Environment.FailFast(System.String, System.Exception)
   at Microsoft.PowerShell.UnmanagedPSEntry.Start(System.String[], Int32)
   at Microsoft.PowerShell.ManagedPSEntry.Main(System.String[])
System.TypeInitializationException: The type initializer for 'System.Management.Automation.Runspaces.InitialSessionState' threw an exception.
 ---> System.ComponentModel.Win32Exception (126): 找不到指定的模块。
   at System.Management.Automation.Internal.SecuritySupport.GetSaferPolicy(String path, SafeHandle handle)
   at System.Management.Automation.Security.SystemPolicy.TestSaferPolicy(String testPathScript, String testPathModule)
   at System.Management.Automation.Security.SystemPolicy.GetAppLockerPolicy(String path, SafeHandle handle)
   at System.Management.Automation.Security.SystemPolicy.GetLockdownPolicy(String path, SafeHandle handle, Nullable`1 canExecuteResult)
   at System.Management.Automation.Security.SystemPolicy.GetLockdownPolicy(String path, SafeHandle handle)
   at System.Management.Automation.Security.SystemPolicy.GetSystemLockdownPolicy()
   at System.Management.Automation.Runspaces.InitialSessionState..cctor()
   --- End of inner exception stack trace ---
   at System.Management.Automation.Runspaces.InitialSessionState.CreateDefault2()
   at Microsoft.PowerShell.UnmanagedPSEntry.Start(String[] args, Int32 argc)


### What is the expected behavior?

_No response_

### Additional information

_No response_