Enable sandboxed V8 for code mode (#36374)

## Why

Code mode must link against a V8 build with sandbox support, but Windows MSVC
still used upstream non-sandboxed prebuilts and package builds selected the
older release artifact profile.

## What changed

- Enable the `v8_enable_sandbox` feature directly for the code mode runtime.
- Select the `ptrcomp_sandbox_release` archive and bindings in Cargo packaging
  and CI, including Windows MSVC release builds.
- Point Bazel's Windows MSVC targets at the sandbox-enabled Codex artifacts and
  enable the matching crate feature.

## Testing

Add a runtime test that calls `v8__V8__IsSandboxEnabled()` and verifies that
the linked V8 library has sandbox support enabled.

GitOrigin-RevId: c1b49b44a6ccfea5b5006d69ec7866848d1cddd7

scripts/codex_package/v8.py

@@ -11,11 +11,10 @@ from dataclasses import dataclass
 from pathlib import Path
 from urllib.request import urlopen
 
-from .targets import REPO_ROOT
-from .targets import TargetSpec
-
+from .targets import REPO_ROOT, TargetSpec
 
 DOWNLOAD_TIMEOUT_SECS = 120
+V8_ARTIFACT_PROFILE = "ptrcomp_sandbox_release"
 
 
 @dataclass(frozen=True)
@@ -30,9 +29,6 @@ def resolve_codex_v8_cargo_env(
     environ: Mapping[str, str] | None = None,
     cache_root: Path | None = None,
 ) -> dict[str, str]:
-    if spec.is_windows:
-        return {}
-
     environ = os.environ if environ is None else environ
     if environ.get("V8_FROM_SOURCE") in {"true", "1", "yes"}:
         return {}
@@ -59,20 +55,23 @@ def fetch_codex_v8_artifacts(
     version: str | None = None,
     cache_root: Path | None = None,
 ) -> RustyV8ArtifactPair:
-    if spec.is_windows:
-        raise RuntimeError(
-            f"No Codex-built V8 release artifacts for target: {spec.target}"
-        )
-
     version = version or resolved_v8_crate_version()
     release_url = (
         f"https://github.com/openai/codex/releases/download/rusty-v8-v{version}"
     )
     target = spec.target
     cache_dir = (cache_root or default_cache_root()) / f"rusty-v8-{version}-{target}"
-    archive = cache_dir / f"librusty_v8_release_{target}.a.gz"
-    binding = cache_dir / f"src_binding_release_{target}.rs"
-    checksums = cache_dir / f"rusty_v8_release_{target}.sha256"
+
+    if spec.is_windows:
+        archive_name = f"rusty_v8_{V8_ARTIFACT_PROFILE}_{target}.lib.gz"
+    else:
+        archive_name = f"librusty_v8_{V8_ARTIFACT_PROFILE}_{target}.a.gz"
+    binding_name = f"src_binding_{V8_ARTIFACT_PROFILE}_{target}.rs"
+    checksums_name = f"rusty_v8_{V8_ARTIFACT_PROFILE}_{target}.sha256"
+
+    archive = cache_dir / archive_name
+    binding = cache_dir / binding_name
+    checksums = cache_dir / checksums_name
 
     download_file(f"{release_url}/{checksums.name}", checksums)
     expected_checksums = load_checksums(checksums, {archive.name, binding.name})