fix(plugin): avoid PATH lookup during MCP launch

[ianw-oai]

Motivation

• The Unix MCP launcher used $(dirname "$0"), which performs an external dirname lookup via PATH and can run repository-controlled executables before the launcher selects a managed Node runtime.

Description

• Replace the external dirname invocation with shell parameter expansion and the shell builtin cd to compute the launcher's directory in sdk/typescript/_bundled_plugin/scripts/launch_codex_security_mcp.
• Use a small case to preserve both slash-qualified and bare invocation paths and then canonicalize with cd and pwd so no external utilities are invoked.
• Add a regression test sdk/typescript/tests-ts/mcp-launcher.test.ts that places a synthetic dirname on PATH, starts the launcher, and asserts the synthetic executable is not executed.
• No functional change to Windows launcher behavior or to the managed Node selection logic beyond eliminating the unsafe lookup.

Testing

• Ran bun test --timeout 30000 tests-ts/mcp-launcher.test.ts, and the new test passed.
• Ran the full package test suite with pnpm run test -- --seed 12345, and the tests passed.
• Ran pnpm run types and pnpm run format, and both checks passed.
• Ran git diff --check to verify formatting and whitespace, and it passed.

---

Codex Task