execpolicy check does not mirror runtime PowerShell wrapper unwrapping #24201

codex execpolicy check appears not to use the same PowerShell-wrapper normalization as the runtime approval path on Windows.

Observed behavior:

• Runtime approval is expected to unwrap top-level PowerShell commands such as pwsh.exe -Command "gh issue view ..." and evaluate rules against the inner command, following the behavior added in PR execpolicy: unwrap PowerShell -Command wrappers on Windows #20336.
• codex execpolicy check, however, appears to match the raw command tokens directly.
• A rule such as prefix_rule(pattern=["gh", "issue"], decision="allow") reports allow for direct gh issue ....
• The same rule does not match when checking a wrapped command shaped like C:\Program Files\PowerShell\7\pwsh.exe -Command "gh issue view ...".
• This makes execpolicy check unreliable as a way to validate whether a user rule will suppress runtime approval prompts on Windows.

The source seems to explain the difference: runtime approval goes through core/src/exec_policy.rs and commands_for_exec_policy(), while execpolicy check appears to call policy matching directly over the provided command tokens.

Expected: codex execpolicy check should either use the same command normalization path as runtime approval, or the docs/help should clearly say it only validates raw policy matching and does not model runtime shell-wrapper normalization.