[Bug]: Codex shadow home symlinks unclassified auth-like entries

Area: apps/server
Version: current main at 45c0dff8ec33a023c79ccb4e06494309253d1c25

Codex shadow-home materialization treats only exact auth.json and models_cache.json as private. Other shared-home entries are symlinked into the shadow home, including auth-like filenames

Reproduction:

1. Create disposable shared and shadow Codex homes
2. Add mode-0600 fixtures auth-fixture-a.json, auth_fixture_b.json, and auth.json.bak to the shared home
3. Add a mode-0600 auth.json fixture to the shadow home
4. Run resolveCodexHomeLayout and materializeCodexShadowHome
5. Inspect file types and targets with lstat and readlink

Actual result:

1. The three shared auth-like fixtures become shadow-home symlinks
2. The shadow's exact auth.json remains private

Expected result:

1. Credential-like entries remain private to their owning home
2. They are never linked into another shadow home
3. Existing credential-like shadow symlinks fail closed

Suggested correction:

1. Match names beginning with auth followed by end-of-name, dot, underscore, or hyphen
2. Apply the predicate case-insensitively
3. Keep author.json and normal session, config, skill, and cache entries shared

This establishes filesystem topology only. It does not claim Codex reads those files, uses their contents, or corrupts authentication

Fixtures only. No real credential file was read, hashed, copied, moved, renamed, or logged

Start in apps/server at resolveCodexHomeLayout and materializeCodexShadowHome, then reproduce the issue with the disposable shared and shadow homes and the listed fixtures. Inspect file types and targets with lstat and readlink. Done means auth-like names are kept private case-insensitively, existing credential-like shadow symlinks fail closed, and author.json plus normal session, config, skill, and cache entries remain shared.