Pin the Rust toolchain to 1.95.0 (#57373)

## What changed

- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.

GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912

scripts/codex_package/smoke_tests/test_codex_package.py

@@ -18,6 +18,7 @@ Each package contains one entrypoint, not both codex and codex-app-server.
 """
 
 import json
+import re
 import shutil
 import subprocess
 import sys
@@ -176,7 +177,7 @@ def _code_mode_host_symbol_address(
         for line in symbol_output.splitlines()
         if len(parts := line.split(maxsplit=2)) == 3
         and parts[1].lower() == "t"
-        and parts[2] == "codex_code_mode_host::main"
+        and re.fullmatch(r"codex_code_mode_host::main(?:::h[0-9a-f]{16})?", parts[2])
     )