feat: remove OPENAI_API_KEY from env and mlock if set

[bolinfest]

This is potentially breaking behavior, as we now actively remove OPENAI_API_KEY from the environment so that subprocesses cannot inherit this value. We make it available within the codebase as a &'static str, but on UNIX, we use mlock(2) to ensure this value remains resident in RAM and is never paged out to disk. (Admittedly, any logic that makes a local copy of this value could still be paged out to disk.)

Removing OPENAI_API_KEY from the environment entails an unsafe use of std::env::remove_var(), so we exercise this logic as part of arg0_dispatch_or_else() to ensure we use it before any threads are created.

Note we make this modification after the checks for codex_linux_sandbox::run_main() and codex_apply_patch::main() to ensure we do not modify the environment in those cases.

---

Stack created with Sapling. Best reviewed with ReviewStack.

• feat: introduce responses-api-proxy #4246
• -> feat: remove OPENAI_API_KEY from env and mlock if set #4243