Enable sandboxed V8 for code mode (#36374)

## Why

Code mode must link against a V8 build with sandbox support, but Windows MSVC
still used upstream non-sandboxed prebuilts and package builds selected the
older release artifact profile.

## What changed

- Enable the `v8_enable_sandbox` feature directly for the code mode runtime.
- Select the `ptrcomp_sandbox_release` archive and bindings in Cargo packaging
  and CI, including Windows MSVC release builds.
- Point Bazel's Windows MSVC targets at the sandbox-enabled Codex artifacts and
  enable the matching crate feature.

## Testing

Add a runtime test that calls `v8__V8__IsSandboxEnabled()` and verifies that
the linked V8 library has sandbox support enabled.

GitOrigin-RevId: c1b49b44a6ccfea5b5006d69ec7866848d1cddd7

.github/actions/setup-rusty-v8/action.yml

@@ -19,14 +19,25 @@ runs:
         release_tag="rusty-v8-v${version}"
         base_url="https://github.com/openai/codex/releases/download/${release_tag}"
         binding_dir="${RUNNER_TEMP}/rusty_v8"
-        archive_path="${binding_dir}/librusty_v8_release_${TARGET}.a.gz"
-        binding_path="${binding_dir}/src_binding_release_${TARGET}.rs"
-        checksums_path="${binding_dir}/rusty_v8_release_${TARGET}.sha256"
+        
+        profile="ptrcomp_sandbox_release"
+
+        if [[ "$TARGET" == *-pc-windows-msvc ]]; then
+          archive_name="rusty_v8_${profile}_${TARGET}.lib.gz"
+        else
+          archive_name="librusty_v8_${profile}_${TARGET}.a.gz"
+        fi
+        binding_name="src_binding_${profile}_${TARGET}.rs"
+        checksums_name="rusty_v8_${profile}_${TARGET}.sha256"
+
+        archive_path="${binding_dir}/${archive_name}"
+        binding_path="${binding_dir}/${binding_name}"
+        checksums_path="${binding_dir}/${checksums_name}"
 
         mkdir -p "${binding_dir}"
-        curl -fsSL "${base_url}/librusty_v8_release_${TARGET}.a.gz" -o "${archive_path}"
-        curl -fsSL "${base_url}/src_binding_release_${TARGET}.rs" -o "${binding_path}"
-        curl -fsSL "${base_url}/rusty_v8_release_${TARGET}.sha256" -o "${checksums_path}"
+        curl -fsSL "${base_url}/${archive_name}" -o "${archive_path}"
+        curl -fsSL "${base_url}/${binding_name}" -o "${binding_path}"
+        curl -fsSL "${base_url}/${checksums_name}" -o "${checksums_path}"
 
         if [[ "$(wc -l < "${checksums_path}")" -ne 2 ]]; then
           echo "Expected exactly two checksums for ${TARGET} in ${checksums_path}" >&2

.github/workflows/rust-ci-full.yml

@@ -373,8 +373,7 @@ jobs:
         shell: bash
         run: bash "${GITHUB_WORKSPACE}/.github/scripts/install-musl-build-tools.sh"
 
-      - if: ${{ !contains(matrix.target, 'windows') }}
-        name: Configure rusty_v8 artifact overrides and verify checksums
+      - name: Configure rusty_v8 artifact overrides and verify checksums
         uses: ./.github/actions/setup-rusty-v8
         with:
           target: ${{ matrix.target }}

.github/workflows/rust-release-windows.yml

@@ -88,6 +88,11 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
+      - name: Configure rusty_v8 artifact overrides and verify checksums
+        uses: ./.github/actions/setup-rusty-v8
+        with:
+          target: ${{ matrix.target }}
+
       - name: Configure LLVM linker
         uses: ./.github/actions/setup-msvc-env
         with: