Pin the Rust toolchain to 1.95.0 (#57373)

## What changed

- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.

GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912

codex-rs/utils/stream-parser/src/inline_hidden_tag.rs

@@ -92,7 +92,7 @@ where
             .iter()
             .map(|spec| longest_suffix_prefix_len(pending, spec.open))
             .max()
-            .unwrap_or(0)
+            .map_or(0, std::convert::identity)
     }
 
     fn push_visible_prefix(out: &mut StreamTextChunk<ExtractedInlineTag<T>>, pending: &str) {