Fix voice runtime release builds and packaging (#44062)

## What changed

- Build the voice host and native runtime with Bazel's `-c opt` configuration.
- Resolve runtime paths before validating their contents in the release workflow.
- Make `runtime.json` owner-writable before sealing the post-signing release receipt.
- Use `scripts` in `PYTHONPATH` so archive creation can import `codex_package.archive`.

GitOrigin-RevId: 02f960573a4151f52cde486e17e1d45b73435306

.github/scripts/build-codex-package-archive.sh

@@ -225,7 +225,7 @@ if [[ -n "$voice_signed_dir" ]]; then
     --build-commit "$(git -C "$repo_root" rev-parse HEAD)" \
     --release-version "$release_version" \
     --output "$voice_package"
-  PYTHONPATH="${repo_root}/public/scripts" "$python_bin" - \
+  PYTHONPATH="${repo_root}/scripts" "$python_bin" - \
     "$voice_package" "$gzip_archive_path" "$zstd_archive_path" <<'PY'
 import sys
 from pathlib import Path

.github/workflows/rust-release.yml

@@ -517,13 +517,13 @@ jobs:
           # Release tags bump Cargo.toml without rewriting the workspace lockfile.
           # Refresh workspace versions before Bazel reads the Cargo dependency graph.
           (cd codex-rs && cargo update --workspace)
-          bazel build //codex-rs/voice-host:codex-voice-host //third_party/voice:native_runtime
+          bazel build -c opt //codex-rs/voice-host:codex-voice-host //third_party/voice:native_runtime
           runtime="bazel-bin/third_party/voice/native_runtime_${PREFIX}"
           PYTHONPATH=third_party/voice python3 - "$runtime" "$TARGET" <<'PY'
           from pathlib import Path
           import sys
           from package_runtime import runtime_files
-          runtime_files(Path(sys.argv[1]), sys.argv[2])
+          runtime_files(Path(sys.argv[1]).resolve(strict=True), sys.argv[2])
           PY
           mkdir -p "voice-unsigned/${TARGET}"
           cp -R "$runtime" "voice-unsigned/${TARGET}/runtime"
@@ -863,7 +863,7 @@ jobs:
           from pathlib import Path
           import sys
           from package_runtime import runtime_files
-          runtime_files(Path(sys.argv[1]), sys.argv[2], public_release=True)
+          runtime_files(Path(sys.argv[1]).resolve(strict=True), sys.argv[2], public_release=True)
           PY
           while IFS= read -r -d '' binary; do
             lipo "$binary" -verify_arch "$arch"
@@ -1330,7 +1330,7 @@ jobs:
           from runtime import digest
 
           voice, target, package = map(Path, sys.argv[1:])
-          runtime_files(voice, str(target), public_release=True)
+          runtime_files(voice.resolve(strict=True), str(target), public_release=True)
           manifest = json.loads((voice / "manifest.json").read_text())
           assert manifest["buildCommit"] == __import__("os").environ["VOICE_BUILD_COMMIT"]
           for relative, expected in manifest["sha256"].items():

third_party/voice/release_runtime.py

@@ -37,6 +37,7 @@ def seal(root: Path, target: str) -> None:
         record["sha256"] = digest(root / record["path"])
     manifest["developmentOnly"] = False
     manifest["distribution"] = "publicRelease"
+    manifest_path.chmod(manifest_path.stat().st_mode | 0o200)
     manifest_path.write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
     runtime_files(root, target, public_release=True)