Configure the Opus Bazel patch and isolate auth tests (#59752)

## What changed

- Configure Bazel to apply `opusic_sys_install_headers.patch` to `opusic-sys` with `-p1`.
- Run the cloud-managed MCP OAuth test with `--no-browser` and keep stdin open until the child exits so EOF cannot race the HTTP callback.
- Serialize the cancelled-refresh test with other auth environment tests and temporarily clear the access-token environment variable.

GitOrigin-RevId: ad76b72ae98320bd0e3ff3231e1ed874332ce38c

MODULE.bazel

@@ -671,6 +671,8 @@ crate.annotation(
         "@rules_foreign_cc//toolchains:current_ninja_toolchain",
     ],
     crate = "opusic-sys",
+    patch_args = ["-p1"],
+    patches = ["//patches:opusic_sys_install_headers.patch"],
 )
 
 # The musl CLI's allocator needs declared native tools and consistent header flags.

codex-rs/cli/tests/cloud_config.rs

@@ -258,9 +258,17 @@ async fn login_and_logout_persist_only_cloud_managed_mcp_oauth_credentials() ->
         .mount(&fixture.server)
         .await;
 
-    let mut command = fixture.command(&["mcp", "login", MANAGED_SERVER_NAME])?;
-    command.stdout(Stdio::piped()).stderr(Stdio::inherit());
+    let mut command = fixture.command(&["mcp", "login", MANAGED_SERVER_NAME, "--no-browser"])?;
+    command
+        .stdin(Stdio::piped())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::inherit());
     let mut child = command.spawn()?;
+    // Keep input open through child.wait() so the HTTP callback cannot race EOF.
+    let _stdin = child
+        .stdin
+        .take()
+        .context("MCP login did not provide stdin")?;
     let stdout = child
         .stdout
         .take()

codex-rs/login/src/auth/auth_tests.rs

@@ -60,7 +60,9 @@ fn header_auth_exposes_a_valid_chatgpt_account_id() {
 }
 
 #[tokio::test]
+#[serial(codex_auth_env)]
 async fn cancelled_refresh_marks_only_started_exchanges_as_unsettled() -> anyhow::Result<()> {
+    let _access_token_guard = remove_access_token_env_var();
     let home = tempdir()?;
     write_auth_file(
         AuthFileParams {