Use executable fixture copying in the bundled bwrap test (#49246)

## Why

Copying executable fixtures in the test process can expose writable file descriptors to sibling spawns. The shared `copy_executable` helper completes copies in a separate process on Linux before launching the fixtures.

## What changed

Use `copy_executable` for both `codex-linux-sandbox` and `bwrap` in `bazel_build_rejects_tampered_bundled_bwrap`, and add `codex-utils-cargo-bin` as a Linux test dependency.

GitOrigin-RevId: 05fb1381eeefb64568b525925c9e81863acc2b54

codex-rs/Cargo.lock

@@ -3756,6 +3756,7 @@ dependencies = [
  "codex-sandboxing",
  "codex-uds",
  "codex-utils-absolute-path",
+ "codex-utils-cargo-bin",
  "globset",
  "landlock",
  "libc",

codex-rs/linux-sandbox/Cargo.toml

@@ -37,6 +37,7 @@ url = { workspace = true }
 
 [target.'cfg(target_os = "linux")'.dev-dependencies]
 codex-core = { workspace = true }
+codex-utils-cargo-bin = { workspace = true }
 pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
 test-case = "3.3.1"

codex-rs/linux-sandbox/tests/suite/bundled_bwrap.rs

@@ -2,7 +2,9 @@
 
 use codex_linux_sandbox::BUNDLED_BWRAP_DIGEST_VERIFICATION_FAILURE_EXIT_CODE;
 use codex_protocol::models::PermissionProfile;
+use codex_utils_cargo_bin::copy_executable;
 use pretty_assertions::assert_eq;
+use std::path::Path;
 use std::path::PathBuf;
 use std::process::Command;
 
@@ -27,11 +29,14 @@ fn bazel_build_rejects_tampered_bundled_bwrap() {
     std::fs::create_dir(&resources).expect("package resource directory should be created");
 
     let sandbox_binary = package.path().join("codex-linux-sandbox");
-    std::fs::copy(env!("CARGO_BIN_EXE_codex-linux-sandbox"), &sandbox_binary)
-        .expect("sandbox binary should be copied into the package");
+    copy_executable(
+        Path::new(env!("CARGO_BIN_EXE_codex-linux-sandbox")),
+        &sandbox_binary,
+    )
+    .expect("sandbox binary should be copied into the package");
 
     let bundled_bwrap = resources.join("bwrap");
-    std::fs::copy(&bwrap_binary, &bundled_bwrap)
+    copy_executable(&bwrap_binary, &bundled_bwrap)
         .expect("built bwrap should be copied into the package");
 
     let permission_profile = serde_json::to_string(&PermissionProfile::read_only())