Support alpha hotfix release versions (#34463)

## What changed

- Map Python `aN.postM` versions to Codex `-alpha.N.M` release tags through shared release-version helpers.
- Accept alpha hotfix versions in Python runtime workflows, Rust release validation, npm publishing, and the shell and PowerShell installers.

## Testing

- Cover version conversion, workflow output, runtime setup, artifact staging, and installer handling for alpha hotfix releases.

GitOrigin-RevId: b95edb56f7c93b435a8050c10f0202dc117e6669

scripts/install/install.ps1

@@ -71,8 +71,8 @@ function Assert-ValidReleaseVersion {
         [string]$Version
     )
 
-    if ($Version -cne "latest" -and $Version -cnotmatch "^[0-9]+\.[0-9]+\.[0-9]+(?:-(?:alpha|beta)(?:\.[0-9]+)?)?$") {
-        throw "Invalid Codex release version: $Version. Expected latest or x.y.z[-alpha[.N]|-beta[.N]]."
+    if ($Version -cne "latest" -and $Version -cnotmatch "^[0-9]+\.[0-9]+\.[0-9]+(?:-alpha(?:\.[0-9]+){0,2}|-beta(?:\.[0-9]+)?)?$") {
+        throw "Invalid Codex release version: $Version. Expected latest or x.y.z[-alpha[.N[.M]]|-beta[.N]]."
     }
 }
 

scripts/install/install.sh

@@ -55,8 +55,8 @@ validate_version() {
     return
   fi
 
-  if ! printf '%s\n' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-(alpha|beta)(\.[0-9]+)?)?$'; then
-    echo "Invalid Codex release version: $version. Expected latest or x.y.z[-alpha[.N]|-beta[.N]]." >&2
+  if ! printf '%s\n' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+(-alpha(\.[0-9]+){0,2}|-beta(\.[0-9]+)?)?$'; then
+    echo "Invalid Codex release version: $version. Expected latest or x.y.z[-alpha[.N[.M]]|-beta[.N]]." >&2
     exit 1
   fi
 }

scripts/install/test_install_sh.py

@@ -48,6 +48,22 @@ class InstallShTest(unittest.TestCase):
         )
         self.assertIn(f"Resolved version: {VERSION}", result.stdout)
 
+    def test_alpha_hotfix_release_is_valid(self) -> None:
+        version = "0.145.0-alpha.23.1"
+        result, requests = run_installer(version)
+
+        self.assertNotEqual(result.returncode, 0)
+        self.assertEqual(
+            requests,
+            [
+                "https://api.github.com/repos/openai/codex/releases/tags/"
+                f"rust-v{version}",
+                "https://github.com/openai/codex/releases/download/"
+                f"rust-v{version}/codex-package_SHA256SUMS",
+            ],
+        )
+        self.assertIn(f"Resolved version: {version}", result.stdout)
+
     def test_latest_release_reuses_version_metadata(self) -> None:
         result, requests = run_installer("latest")