build: add sandbox rusty_v8 artifact lane

Produce explicitly named sandbox release pairs alongside the current compatibility artifacts, and validate staged sandbox outputs before publication across the supported artifact targets.

Co-authored-by: Codex <noreply@openai.com>

third_party/v8/BUILD.bazel

@@ -364,6 +364,18 @@ cc_static_library(
     features = V8_STATIC_LIBRARY_FEATURES,
 )
 
+cc_static_library(
+    name = "v8_147_4_0_aarch64_pc_windows_msvc_bazel",
+    deps = [":v8_147_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_pc_windows_msvc_bazel",
+    deps = [":v8_147_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
 filegroup(
     name = "src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
     srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_unknown_linux_gnu"],
@@ -374,6 +386,16 @@ filegroup(
     srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
 )
 
+filegroup(
+    name = "src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_pc_windows_msvc"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_pc_windows_msvc"],
+)
+
 filegroup(
     name = "rusty_v8_release_pair_x86_64_apple_darwin",
     srcs = [
@@ -437,3 +459,35 @@ filegroup(
         ":src_binding_release_aarch64_pc_windows_msvc",
     ],
 )
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl",
+    srcs = [
+        ":v8_147_4_0_x86_64_unknown_linux_musl_release",
+        ":src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl",
+    srcs = [
+        ":v8_147_4_0_aarch64_unknown_linux_musl_release",
+        ":src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_pc_windows_msvc",
+    srcs = [
+        ":v8_147_4_0_x86_64_pc_windows_msvc_bazel",
+        ":src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_pc_windows_msvc",
+    srcs = [
+        ":v8_147_4_0_aarch64_pc_windows_msvc_bazel",
+        ":src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+    ],
+)

third_party/v8/README.md

@@ -40,7 +40,7 @@ The consumer-facing selectors are:
 - `//third_party/v8:rusty_v8_archive_for_target`
 - `//third_party/v8:rusty_v8_binding_for_target`
 
-Musl release assets are expected at the tag:
+Current musl release assets are expected at the tag:
 
 - `rusty-v8-v<crate_version>`
 
@@ -49,13 +49,32 @@ with these raw asset names:
 - `librusty_v8_release_<target>.a.gz`
 - `src_binding_release_<target>.rs`
 
+During the sandbox rollout, sandbox-enabled assets are published alongside those
+current assets on the same tag, with the Rust crate's sandbox feature suffix in
+their raw names:
+
+- `librusty_v8_ptrcomp_sandbox_release_<target>.a.gz`
+- `rusty_v8_ptrcomp_sandbox_release_<target>.lib.gz`
+- `src_binding_ptrcomp_sandbox_release_<target>.rs`
+
 The dedicated publishing workflow is `.github/workflows/rusty-v8-release.yml`.
-It builds musl release pairs from source and keeps the release artifacts as the
-statically linked form:
+Every tagged run builds the current musl release pairs from source and keeps the
+release artifacts as the statically linked form:
 
 - `//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_musl`
 - `//third_party/v8:rusty_v8_release_pair_aarch64_unknown_linux_musl`
 
+The same run also builds the matching sandbox pair targets:
+
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_pc_windows_msvc`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_pc_windows_msvc`
+
+The workflow validates the staged sandbox outputs before publication by checking
+the emitted checksums, running the focused V8/code-mode sandbox tests, and smoke
+starting a release `codex` binary on every supported artifact target.
+
 Cargo musl builds use `RUSTY_V8_ARCHIVE` plus a downloaded
 `RUSTY_V8_SRC_BINDING_PATH` to point at those `openai/codex` release assets
 directly. We do not use `RUSTY_V8_MIRROR` for musl because the upstream `v8`