fix(rmcp-client): preserve OAuth metadata queries (#5953)

[zemaj]

Summary

• OAuth metadata discovery dropped server query parameters so remote MCP OAuth servers (e.g. Supabase) served 404s and the CLI fell back to bogus /authorize URLs
• patch the vendored rmcp client to retain the original query string when probing /.well-known/oauth-authorization-server and add a regression test that fails without it
• vendor the patched crate plus a git cc dependency so metadata discovery and downstream builds succeed

Testing

• cargo test -p code-rmcp-client discover_metadata_preserves_query_parameters -- --nocapture
• ./build-fast.sh

Closes openai#5953.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Respect inherit=none when restoring PATH/NVM

The new logic unconditionally reinserts any discovered PATH and NVM_DIR entries after filtering. When ShellEnvironmentPolicyInherit::None is selected, the caller expects a completely clean environment except for explicit overrides (see test_inherit_none). The loop re‑adding preserved vars ignores that contract and now leaks the parent process’s PATH/NVM_DIR into supposedly isolated executions. This both regresses existing behaviour and breaks environments that relied on inherit: None for sandboxing. Consider skipping the preservation step when the policy forbids inheritance or when the variables were deliberately excluded.

Useful? React with 👍 / 👎.