Verify bundled bwrap in Bazel builds (#38494)

## Why

Bazel builds did not embed the SHA-256 digest used to verify the bundled
`bwrap` binary at launch.

## What changed

- Strip the Bazel-built `bwrap`, generate its SHA-256 digest, and pass that
  digest to `codex-linux-sandbox` through a compiler environment file.
- Report digest verification failures with exit code `8` instead of panicking.
- Add a Bazel integration test that accepts the original bundled binary and
  rejects a tampered copy.

GitOrigin-RevId: 224eeb6ae3d1bfb100e048b296f75fd8ba109581

codex-rs/linux-sandbox/src/bundled_bwrap.rs

@@ -40,8 +40,10 @@ impl BundledBwrapLauncher {
                 self.program.as_path().display()
             )
         });
-        verify_digest(&bwrap_file, expected_sha256(), self.program.as_path())
-            .unwrap_or_else(|err| panic!("{err}"));
+        if let Err(err) = verify_digest(&bwrap_file, expected_sha256(), self.program.as_path()) {
+            eprintln!("{err}");
+            std::process::exit(crate::BUNDLED_BWRAP_DIGEST_VERIFICATION_FAILURE_EXIT_CODE);
+        }
 
         make_files_inheritable(&preserved_files);
 

codex-rs/linux-sandbox/src/lib.rs

@@ -22,6 +22,10 @@ mod proxy_lifecycle;
 #[cfg(target_os = "linux")]
 mod proxy_routing;
 
+/// Exit status returned when bundled bubblewrap fails digest verification.
+#[cfg(target_os = "linux")]
+pub const BUNDLED_BWRAP_DIGEST_VERIFICATION_FAILURE_EXIT_CODE: i32 = 8;
+
 #[cfg(target_os = "linux")]
 pub fn run_main() -> ! {
     linux_run_main::run_main();