fix(windows): honor dedupe environment settings - #696

Summary

The deduplication review runner copies the environment into a plain object, losing Windows' case-insensitive lookup behavior. Differently cased API-key and home-directory settings then stop working as intended. An empty primary key also hides a valid alternate key, and empty home settings should use the existing default directories.

Changes

• Reuse the existing platform-aware environment lookup for both supported API-key names and configured private directories.
• Select the first nonblank API key while preserving its original value. Treat exactly empty home-directory settings as unset.
• Extend the existing transport tests with Windows casing, alternate-key fallback and emitted-directory-policy regressions. Assert the exact synthetic login key.
• Keep Windows sandbox selection identical to main. The initial backend-selection change has been withdrawn; configured-backend compatibility remains separate work.

Testing

• Build, ESLint and formatting checks passed on Windows.
• Focused codex-review and scan-comparison suites: 37 passed, 1 existing Windows skip, 0 failed; 178 assertions, seed 1266991936.
• Three compiled-runner controls and three native pre-turn controls passed for empty, whitespace-only and differently cased primary keys. They verified the exact fallback key, ephemeral local account state, unchanged synthetic configuration and child cleanup.
• Empty-home coverage uses an isolated mock-only test; native controls use nonempty synthetic homes. No provider request, model turn, native tool, sandbox backend or elevated setup was exercised.
• The initial PR head had one Windows Node 22 login-readiness CI failure. That head's same-seed local Node 22 replay of the complete API test file passed 137/137; the remote cause remains unclassified. No test timeout or CI policy was changed. CI must validate the revised head.

Risk and rollout

Small caller-level environment changes; the shared helper retains exact-key precedence and case-sensitive behavior on other platforms. Nonempty path values are preserved. No new CLI surface, default sandbox change, migration or release step is introduced. These focused checks do not establish full model-backed deduplication or sandbox enforcement.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.