Avoid copying app-server in zsh-fork tests

[Harold Hunt (huntharo)]

Summary

• hard-link the resolved codex-app-server into each package-shaped zsh-fork fixture
• canonicalize runfiles paths before linking and fall back to the existing permission-preserving copy when linking is unavailable
• cover hard-link selection through a symlinked source path

Motivation

The macOS debug executable measured 464,190,928 bytes. Four independent copies allocate about 1,856,765,952 bytes and trigger repeated provenance/Gatekeeper work in syspolicyd. Four hard links retain the required test-package/bin launch path while sharing one inode and adding no executable data blocks.

Verification

• PASS: just test -p codex-app-server --test all hard_link_or_copy_with_permissions_prefers_hard_link
• zsh-fork focused run: four of five selected cases passed; turn_start_shell_zsh_fork_subcommand_decline_marks_parent_declined_v2 remains timing-sensitive (Failed versus Declined). An A/B run with the original copy implementation reproduced the same failure and then passed on nextest retry.
• PASS: just fmt
• PASS: just fix -p codex-app-server (two pre-existing too_many_arguments warnings)