fix: stop honoring CODEX_MANAGED_CONFIG_PATH environment variable in production

[bolinfest]

Previously, CODEX_MANAGED_CONFIG_PATH could be used to override the path used to read managed config data, /etc/codex/managed_config.toml:

codex/codex-rs/core/src/config_loader/layer_io.rs

Lines 97 to 100 in 771f1ca

	pub(super) fn managed_config_default_path(codex_home: &Path) -> PathBuf {
	if let Ok(path) = std::env::var("CODEX_MANAGED_CONFIG_PATH") {
	return PathBuf::from(path);
	}

While I believe this was designed to facilitate creating integration tests with test values of managed_config.toml, this also meant that end-users could use CODEX_MANAGED_CONFIG_PATH to circumvent policies defined in /etc/codex/managed_config.toml, which was likely not the intention of the policy author.

This PR plugs this loophole by:

• Updating the shared managed_config_default_path() function to no longer honor CODEX_MANAGED_CONFIG_PATH.
• Updating only the codex-app-server standalone binary to honor the environment variable, and only in debug builds.