Windows standalone: sandbox helpers resolved relative to PATH shim, not package release dir (breaks all sandboxed exec)

On a standalone Windows install, every sandboxed codex exec (read-only and workspace-write) fails at the first tool call because the sandbox helper binaries cannot be found.

Symptoms

ERROR codex_core::exec: exec error: windows sandbox: orchestrator_helper_launch_failed:
  setup refresh failed to launch helper: helper=codex-windows-sandbox-setup.exe, error=program not found

and, once the setup helper is located, a second failure:

helper copy failed for command-runner: helper not found next to current executable or under
  codex-resources: C:\Users\<user>\AppData\Local\Programs\OpenAI\Codex\bin\codex.exe;
  falling back to legacy path codex-command-runner.exe
ERROR codex_core::exec: exec error: windows sandbox: CreateProcessWithLogonW failed: 2

Root cause

codex resolves codex-windows-sandbox-setup.exe and codex-command-runner.exe "next to the current executable or under codex-resources" — but the current executable is the PATH shim at AppData\Local\Programs\OpenAI\Codex\bin\codex.exe, whereas the helpers actually ship under the package release dir: ~/.codex/packages/standalone/releases/<version>/codex-resources/. The command-runner then falls back to a bare filename, and because it is launched via CreateProcessWithLogonW for the restricted CodexSandboxOffline user (fresh environment, no inherited PATH), that bare name cannot be found, giving error 2.

Workaround (confirmed)

Copy both helpers from the release codex-resources dir into the shim's bin dir:

copy "~\.codex\packages\standalone\releases\<ver>\codex-resources\codex-windows-sandbox-setup.exe"  "~\AppData\Local\Programs\OpenAI\Codex\bin\"
copy "~\.codex\packages\standalone\releases\<ver>\codex-resources\codex-command-runner.exe"        "~\AppData\Local\Programs\OpenAI\Codex\bin\"

After copying, a sandboxed workspace-write codex exec completes normally. This must be re-applied after every CLI upgrade, since the new release dir's helpers are not copied to the shim bin.

Environment

Windows 11 (10.0.26200), standalone install, reproduced on both codex-cli 0.144.0 and 0.144.1. Not elevation-related; the elevated desktop instance works only because its helpers happen to be co-located. Suggested fix: resolve helpers relative to the resolved package release dir, which codex doctor already reports, rather than the PATH shim, and/or pass an absolute command-runner path into the CreateProcessWithLogonW launch.