`codex-home` input is ignored when `safety-strategy` is `unprivileged-user`

codex-home is passed via environment variables of subprocess.spawn.
https://github.com/openai/codex-action/blob/e0fdf01220eb9a88167c4898839d273e3f2609d1/src/runCodexExec.ts#L167-L170

However, if safety-strategy: unprivileged-user is set, the command is prefixed with sudo -u ${codexUser} --:
https://github.com/openai/codex-action/blob/e0fdf01220eb9a88167c4898839d273e3f2609d1/src/runCodexExec.ts#L117

The problem is, sudo does not pass enviroment variables unless -E(--preserve-env) flag is set.
This causes configuration mismatch, usually leading to 401 Unauthorized because proxy config is not applied:

ERROR codex_api::endpoint::responses_websocket: failed to connect to websocket: HTTP error: 401 Unauthorized, url: wss://api.openai.com/v1/responses
...
ERROR: Reconnecting... 5/5
ERROR: unexpected status 401 Unauthorized: Missing bearer or basic authentication in header, url: https://api.openai.com/v1/responses, cf-ray: ..., request id: ...

The command setup is in src/runCodexExec.ts, especially the environment passed to subprocess.spawn and the sudo prefix around lines 117 and 167-170. Trace both safety-strategy paths and verify that codex-home remains available to the unprivileged command; finish by running the repository’s existing tests.