Pin the Rust toolchain to 1.95.0 (#57373)

## What changed

- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.

GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912

codex-rs/core/src/tools/executed_tool_calls.rs

@@ -369,7 +369,7 @@ impl ExecutedToolCalls {
     fn reserve_direct_call(&self) -> Option<DirectCallPermit> {
         let recording = Arc::downgrade(&self.lock_state().as_ref()?.recording);
         self.pending_direct_calls
-            .try_update(Ordering::Relaxed, Ordering::Relaxed, |pending| {
+            .fetch_update(Ordering::Relaxed, Ordering::Relaxed, |pending| {
                 (pending < MAX_PENDING_EXECUTED_TOOL_CALLS).then_some(pending + 1)
             })
             .ok()?;

codex-rs/core/src/tools/handlers/mcp.rs

@@ -278,7 +278,8 @@ impl McpHandler {
             .map(TruncationPolicy::Tokens)
             .unwrap_or(step_context.settings.model_info.truncation_policy.into());
         let started = Instant::now();
-        let result = handle_mcp_tool_call(
+        // Bound the compiler's async-layout query depth for approval and dispatch.
+        let result = Box::pin(handle_mcp_tool_call(
             Arc::clone(&session),
             &step_context,
             &cancellation_token,
@@ -290,7 +291,7 @@ impl McpHandler {
             tool_name,
             &source,
             payload,
-        )
+        ))
         .await;
 
         Ok(boxed_tool_output(McpToolOutput {