Ship the standalone executor in release packages (#57837)

## What changed

- Include `codex-exec-server` in canonical CLI and app-server packages and advertise its path through `execServer` in `codex-package.json`.
- Build and sign the executor in release workflows, preserve signed prebuilt inputs, and verify packaged signatures. Use empty entitlements for the macOS executor.
- Have installers check for the executor when package metadata advertises it, while continuing to accept older packages.
- Omit the standalone executor and its manifest entry from npm packages to stay within npm's package size limit. Keep `codex exec-server` and its runtime helpers available.

## Testing

Add package smoke tests for executor initialization, version reporting, filesystem and process sandbox enforcement, and invalid-argument/configuration parity with `codex exec-server`. Extend archive, npm staging, and macOS signing tests to cover executor contents, executable permissions, preserved bytes, and entitlement verification.

GitOrigin-RevId: bc741fe7faa6fe631d076de18d448c55247c23c7

scripts/codex_package/cli.py

@@ -140,6 +140,11 @@ def create_parser() -> argparse.ArgumentParser:
             "the host is built with Cargo."
         ),
     )
+    parser.add_argument(
+        "--exec-server-bin",
+        type=Path,
+        help="Optional prebuilt codex-exec-server executable. If omitted, build it with Cargo.",
+    )
     parser.add_argument(
         "--bwrap-bin",
         type=Path,
@@ -210,6 +215,11 @@ def assemble_package(args: argparse.Namespace) -> Path:
             "prebuilt code-mode host executable",
             "--code-mode-host-bin",
         ),
+        exec_server_bin=resolve_optional_input_path(
+            args.exec_server_bin,
+            "prebuilt executor executable",
+            "--exec-server-bin",
+        ),
         bwrap_bin=resolve_optional_input_path(
             args.bwrap_bin,
             "prebuilt Linux bwrap executable",
@@ -229,6 +239,7 @@ def assemble_package(args: argparse.Namespace) -> Path:
     inputs = PackageInputs(
         entrypoint_bin=source_outputs.entrypoint_bin,
         code_mode_host_bin=source_outputs.code_mode_host_bin,
+        exec_server_bin=source_outputs.exec_server_bin,
         rg_bin=resolve_rg_bin(spec, args.rg_bin),
         bwrap_bin=source_outputs.bwrap_bin,
         codex_command_runner_bin=source_outputs.codex_command_runner_bin,
@@ -239,6 +250,7 @@ def assemble_package(args: argparse.Namespace) -> Path:
     for filename, prebuilt in (
         (variant.entrypoint_name(spec), args.entrypoint_bin),
         (f"codex-code-mode-host{spec.exe_suffix}", args.code_mode_host_bin),
+        (f"codex-exec-server{spec.exe_suffix}", args.exec_server_bin),
     ):
         if args.strip == "all" or (
             args.strip == "auto"