[MCP] Allow specifying cwd and additional env vars (#5246)

This makes stdio mcp servers more flexible by allowing users to specify
the cwd to run the server command from and adding additional environment
variables to be passed through to the server.

Example config using the test server in this repo:
```toml
[mcp_servers.test_stdio]
cwd = "/Users/<user>/code/codex/codex-rs"
command = "cargo"
args = ["run", "--bin", "test_stdio_server"]
env_vars = ["MCP_TEST_VALUE"]
```

@bolinfest I know you hate these env var tests but let's roll with this
for now. I may take a stab at the env guard + serial macro at some
point.

codex-rs/cli/tests/mcp_add_remove.rs

@@ -28,10 +28,18 @@ async fn add_and_remove_server_updates_global_config() -> Result<()> {
     assert_eq!(servers.len(), 1);
     let docs = servers.get("docs").expect("server should exist");
     match &docs.transport {
-        McpServerTransportConfig::Stdio { command, args, env } => {
+        McpServerTransportConfig::Stdio {
+            command,
+            args,
+            env,
+            env_vars,
+            cwd,
+        } => {
             assert_eq!(command, "echo");
             assert_eq!(args, &vec!["hello".to_string()]);
             assert!(env.is_none());
+            assert!(env_vars.is_empty());
+            assert!(cwd.is_none());
         }
         other => panic!("unexpected transport: {other:?}"),
     }

codex-rs/cli/tests/mcp_list.rs

@@ -1,6 +1,9 @@
 use std::path::Path;
 
 use anyhow::Result;
+use codex_core::config::load_global_mcp_servers;
+use codex_core::config::write_global_mcp_servers;
+use codex_core::config_types::McpServerTransportConfig;
 use predicates::prelude::PredicateBooleanExt;
 use predicates::str::contains;
 use pretty_assertions::assert_eq;
@@ -27,8 +30,8 @@ fn list_shows_empty_state() -> Result<()> {
     Ok(())
 }
 
-#[test]
-fn list_and_get_render_expected_output() -> Result<()> {
+#[tokio::test]
+async fn list_and_get_render_expected_output() -> Result<()> {
     let codex_home = TempDir::new()?;
 
     let mut add = codex_command(codex_home.path())?;
@@ -46,6 +49,18 @@ fn list_and_get_render_expected_output() -> Result<()> {
     .assert()
     .success();
 
+    let mut servers = load_global_mcp_servers(codex_home.path()).await?;
+    let docs_entry = servers
+        .get_mut("docs")
+        .expect("docs server should exist after add");
+    match &mut docs_entry.transport {
+        McpServerTransportConfig::Stdio { env_vars, .. } => {
+            *env_vars = vec!["APP_TOKEN".to_string(), "WORKSPACE_ID".to_string()];
+        }
+        other => panic!("unexpected transport: {other:?}"),
+    }
+    write_global_mcp_servers(codex_home.path(), &servers)?;
+
     let mut list_cmd = codex_command(codex_home.path())?;
     let list_output = list_cmd.args(["mcp", "list"]).output()?;
     assert!(list_output.status.success());
@@ -54,6 +69,8 @@ fn list_and_get_render_expected_output() -> Result<()> {
     assert!(stdout.contains("docs"));
     assert!(stdout.contains("docs-server"));
     assert!(stdout.contains("TOKEN=secret"));
+    assert!(stdout.contains("APP_TOKEN=$APP_TOKEN"));
+    assert!(stdout.contains("WORKSPACE_ID=$WORKSPACE_ID"));
     assert!(stdout.contains("Status"));
     assert!(stdout.contains("Auth"));
     assert!(stdout.contains("enabled"));
@@ -79,7 +96,12 @@ fn list_and_get_render_expected_output() -> Result<()> {
               ],
               "env": {
                 "TOKEN": "secret"
-              }
+              },
+              "env_vars": [
+                "APP_TOKEN",
+                "WORKSPACE_ID"
+              ],
+              "cwd": null
             },
             "startup_timeout_sec": null,
             "tool_timeout_sec": null,
@@ -98,6 +120,8 @@ fn list_and_get_render_expected_output() -> Result<()> {
     assert!(stdout.contains("command: docs-server"));
     assert!(stdout.contains("args: --port 4000"));
     assert!(stdout.contains("env: TOKEN=secret"));
+    assert!(stdout.contains("APP_TOKEN=$APP_TOKEN"));
+    assert!(stdout.contains("WORKSPACE_ID=$WORKSPACE_ID"));
     assert!(stdout.contains("enabled: true"));
     assert!(stdout.contains("remove: codex mcp remove docs"));