Enable safe identical code folding for x86-64 musl releases (#59780)

## What changed

Enable `--addrsig` and `--icf=safe` for `x86_64-unknown-linux-musl` release packages in Cargo and Bazel.

Opt Cargo release builds into these flags with `CODEX_MUSL_RELEASE_LINK_FLAGS=1`, selecting `lld` and preserving existing `RUSTFLAGS`. Apply the corresponding flags in Bazel's release package transition for the x86-64 musl platform.

GitOrigin-RevId: ade3c619dad2f03fd93a6fec35477607caec8b31

.github/actions/build-cargo-package-binaries/action.yml

@@ -68,6 +68,7 @@ runs:
       working-directory: codex-rs
       env:
         TARGET: ${{ inputs.target }}
+        CODEX_MUSL_RELEASE_LINK_FLAGS: "1"
       run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
 
     - name: Disable aws-lc jitter entropy (musl)

.github/scripts/install-musl-build-tools.sh

@@ -261,6 +261,12 @@ target_cxx_var="CXX_${TARGET}"
 target_cxx_var="${target_cxx_var//-/_}"
 echo "${target_cxx_var}=${cxx}" >> "$GITHUB_ENV"
 
+# Enable safe identical code folding for release packages on x86-64 musl.
+if [[ "${TARGET}" == "x86_64-unknown-linux-musl" && "${CODEX_MUSL_RELEASE_LINK_FLAGS:-}" == "1" ]]; then
+  link_flags=(-Cllvm-args=--addrsig -Clink-arg=-fuse-ld=lld -Clink-arg=-Wl,--icf=safe)
+  echo "RUSTFLAGS=${RUSTFLAGS:+$RUSTFLAGS }${link_flags[*]}" >> "$GITHUB_ENV"
+fi
+
 cargo_linker_var="CARGO_TARGET_${TARGET^^}_LINKER"
 cargo_linker_var="${cargo_linker_var//-/_}"
 echo "${cargo_linker_var}=${musl_linker}" >> "$GITHUB_ENV"

.github/workflows/rust-release.yml

@@ -208,6 +208,7 @@ jobs:
         name: Install musl build tools
         env:
           TARGET: ${{ matrix.target }}
+          CODEX_MUSL_RELEASE_LINK_FLAGS: "1"
         run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
 
       - if: ${{ matrix.build-system == 'cargo' && contains(matrix.target, 'linux') }}