[Bug]: Codex shadow home symlinks unclassified auth-like entries #8578

Area: apps/server
Version: current main at 45c0dff

Codex shadow-home materialization treats only exact auth.json and models_cache.json as private. Other shared-home entries are symlinked into the shadow home, including auth-like filenames

Reproduction:

1. Create disposable shared and shadow Codex homes
2. Add mode-0600 fixtures auth-fixture-a.json, auth_fixture_b.json, and auth.json.bak to the shared home
3. Add a mode-0600 auth.json fixture to the shadow home
4. Run resolveCodexHomeLayout and materializeCodexShadowHome
5. Inspect file types and targets with lstat and readlink

Actual result:

1. The three shared auth-like fixtures become shadow-home symlinks
2. The shadow's exact auth.json remains private

Expected result:

1. Credential-like entries remain private to their owning home
2. They are never linked into another shadow home
3. Existing credential-like shadow symlinks fail closed

Suggested correction:

1. Match names beginning with auth followed by end-of-name, dot, underscore, or hyphen
2. Apply the predicate case-insensitively
3. Keep author.json and normal session, config, skill, and cache entries shared

This establishes filesystem topology only. It does not claim Codex reads those files, uses their contents, or corrupts authentication

Fixtures only. No real credential file was read, hashed, copied, moved, renamed, or logged