Fix voice runtime release builds and packaging (#44062)

## What changed

- Build the voice host and native runtime with Bazel's `-c opt` configuration.
- Resolve runtime paths before validating their contents in the release workflow.
- Make `runtime.json` owner-writable before sealing the post-signing release receipt.
- Use `scripts` in `PYTHONPATH` so archive creation can import `codex_package.archive`.

GitOrigin-RevId: 02f960573a4151f52cde486e17e1d45b73435306

.github/scripts/build-codex-package-archive.sh

@@ -225,7 +225,7 @@ if [[ -n "$voice_signed_dir" ]]; then
     --build-commit "$(git -C "$repo_root" rev-parse HEAD)" \
     --release-version "$release_version" \
     --output "$voice_package"
-  PYTHONPATH="${repo_root}/public/scripts" "$python_bin" - \
+  PYTHONPATH="${repo_root}/scripts" "$python_bin" - \
     "$voice_package" "$gzip_archive_path" "$zstd_archive_path" <<'PY'
 import sys
 from pathlib import Path