Add shared runtime build information (#37929)

## What changed

- Add `codex-build-info` to resolve a packaged runtime's semantic version from `codex-package.json` while preserving the commit stamped into the executable.
- Represent source builds as version `0.0.0` and expose helpers for display, serialization, and source-build detection.
- Stamp `STABLE_GIT_COMMIT` into final Bazel Rust binaries so Git changes do not invalidate the shared library graph.

## Testing

- Cover packaged, source, legacy, and invalid-version resolution, plus serialization round trips.

GitOrigin-RevId: 669b02449644c738ba2946a1b7aafe4ec31a9edb

defs.bzl

@@ -378,7 +378,6 @@ def codex_rust_crate(
         sanitized_binaries.append(binary)
         cargo_env_runfiles[":" + binary] = "CARGO_BIN_EXE_" + binary
         cargo_env["CARGO_BIN_EXE_" + binary] = "$(rlocationpath :%s)" % binary
-
         rust_binary(
             name = binary,
             crate_name = binary.replace("-", "_"),
@@ -386,7 +385,11 @@ def codex_rust_crate(
             deps = all_crate_deps() + maybe_deps + deps_extra,
             edition = crate_edition,
             rustc_flags = rustc_flags_extra + WINDOWS_RUSTC_LINK_FLAGS,
+            # rules_rust substitutes workspace status values only for stamped
+            # actions, so pass the existing key through to final binaries.
+            rustc_env = {"STABLE_GIT_COMMIT": "{STABLE_GIT_COMMIT}"},
             srcs = native.glob(["src/**/*.rs"]),
+            stamp = 1,
             visibility = ["//visibility:public"],
         )