Ship the standalone executor in release packages (#57837)

## What changed

- Include `codex-exec-server` in canonical CLI and app-server packages and advertise its path through `execServer` in `codex-package.json`.
- Build and sign the executor in release workflows, preserve signed prebuilt inputs, and verify packaged signatures. Use empty entitlements for the macOS executor.
- Have installers check for the executor when package metadata advertises it, while continuing to accept older packages.
- Omit the standalone executor and its manifest entry from npm packages to stay within npm's package size limit. Keep `codex exec-server` and its runtime helpers available.

## Testing

Add package smoke tests for executor initialization, version reporting, filesystem and process sandbox enforcement, and invalid-argument/configuration parity with `codex exec-server`. Extend archive, npm staging, and macOS signing tests to cover executor contents, executable permissions, preserved bytes, and entitlement verification.

GitOrigin-RevId: bc741fe7faa6fe631d076de18d448c55247c23c7

codex-rs/exec-server-cli/BUILD.bazel

@@ -1,4 +1,6 @@
 load("//:defs.bzl", "codex_rust_crate")
+load("//bazel/platforms:release_binaries.bzl", "multiplatform_binaries")
+load("//bazel/rules:runtime_package.bzl", "release_binary")
 
 codex_rust_crate(
     name = "exec-server-cli",
@@ -9,3 +11,7 @@ codex_rust_crate(
     # The standalone integration test launches native OS sandboxes itself.
     test_tags = ["no-sandbox"],
 )
+
+release_binary(binary = ":codex-exec-server")
+
+multiplatform_binaries(name = "codex-exec-server")