Pin the Rust toolchain to 1.95.0 (#57373)

## What changed

- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.

GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912

codex-rs/websocket-auth/src/lib.rs

@@ -444,7 +444,7 @@ fn sha256_digest_arg(flag_name: &str, value: &str) -> anyhow::Result<[u8; 32]> {
     }
 
     let mut digest = [0u8; 32];
-    for (index, pair) in trimmed.as_bytes().as_chunks::<2>().0.iter().enumerate() {
+    for (index, pair) in trimmed.as_bytes().chunks_exact(2).enumerate() {
         let high = hex_nibble(flag_name, pair[0])?;
         let low = hex_nibble(flag_name, pair[1])?;
         digest[index] = (high << 4) | low;