Run Windows sandbox tests exclusively when local (#46507)

## Why

Sandbox setup rotates machine-wide account passwords. The process-local test lock cannot prevent concurrent `exec-server` elevated filesystem tests from changing those passwords between setup and logon.

## What changed

- Add the Bazel `exclusive-if-local` test tag to `windows-sandbox-rs` to prevent this overlap during local test execution.
- Include the full error chain and sandbox log when the elevated non-TTY command test fails to spawn a session.

GitOrigin-RevId: bba87fc606ea60a35cf0451ed0ef68ef2eb14d3a

codex-rs/windows-sandbox-rs/BUILD.bazel

@@ -55,4 +55,8 @@ codex_rust_crate(
         ":codex-command-runner",
         ":codex-windows-sandbox-setup",
     ],
+    # Setup rotates machine-wide account passwords. The process-local test lock
+    # cannot prevent exec-server's elevated filesystem tests from rotating them
+    # between this crate's setup and logon. Windows tests execute locally in CI.
+    test_tags = ["exclusive-if-local"],
 )

codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs

@@ -337,7 +337,12 @@ fn elevated_non_tty_cmd_forwards_env_output_and_exit() {
             /*use_private_desktop*/ true,
         )
         .await
-        .expect("spawn elevated non-tty cmd session");
+        .unwrap_or_else(|err| {
+            panic!(
+                "spawn elevated non-tty cmd session: {err:#}\nsandbox log:\n{}",
+                sandbox_log(codex_home.path())
+            )
+        });
         let (stdout, exit_code) =
             collect_stdout_and_exit(spawned, codex_home.path(), Duration::from_secs(10)).await;
         let stdout = String::from_utf8_lossy(&stdout);