Ship codex-exec-server in CLI and app-server packages (#57590)

## What changed

- Build and bundle the standalone executor in `bin/` for both package variants, and advertise its path through `execServer` in `codex-package.json`.
- Include the executor in Cargo and Bazel release packaging, macOS signing and notarization, and Windows signing verification. Preserve prebuilt signed binaries during packaging.
- Make installers detect a missing advertised executor while continuing to accept older packages without it.

## Testing

Add coverage for executor archive contents and executable permissions, signed binary preservation, and macOS entitlement verification. Add package smoke tests for initialization, version reporting, filesystem and process sandbox enforcement, and startup error parity with `codex exec-server`.

GitOrigin-RevId: 5c0027fc19f16cf9c2a5bb52dbd065a9776bc2af

scripts/codex_package/test_layout.py

@@ -2,6 +2,8 @@
 
 from pathlib import Path
 import hashlib
+import io
+import tarfile
 import json
 import shutil
 import subprocess
@@ -12,6 +14,7 @@ import unittest
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 
 from build_winget_package import prepare_winget_package
+from codex_package.archive import write_archive, resolve_zstd_command
 from codex_package.layout import build_package_dir
 from codex_package.layout import validate_package_dir
 from codex_package.targets import PACKAGE_VARIANTS
@@ -63,6 +66,7 @@ int main(void) {
                     flags = [
                         "--entrypoint-bin",
                         "--code-mode-host-bin",
+                        "--exec-server-bin",
                         "--rg-bin",
                     ]
                     if "linux" in target:
@@ -73,7 +77,7 @@ int main(void) {
                         # Preserved prebuilt inputs must not even need a strip tool.
                         command.extend(("--strip-tool", str(root / "absent-strip")))
                     subprocess.run(command, check=True, capture_output=True)
-                    for name in ("codex", "codex-code-mode-host"):
+                    for name in ("codex", "codex-code-mode-host", "codex-exec-server"):
                         executable = package / "bin" / name
                         self.assertEqual(
                             subprocess.check_output([str(executable)]),
@@ -97,6 +101,7 @@ int main(void) {
                 files = {
                     "bin/codex.exe": b"signed CLI",
                     "bin/codex-code-mode-host.exe": b"signed code mode host",
+                    "bin/codex-exec-server.exe": b"signed executor",
                     "codex-resources/codex-command-runner.exe": b"signed runner",
                     "codex-resources/codex-windows-sandbox-setup.exe": b"signed setup",
                     "codex-resources/voice/bin/codex-voice-host.exe": b"signed voice host",
@@ -172,6 +177,7 @@ int main(void) {
                             code_mode_host_bin=touch_executable(
                                 root / "codex-code-mode-host"
                             ),
+                            exec_server_bin=rg_bin,
                             rg_bin=rg_bin,
                             bwrap_bin=None,
                             codex_command_runner_bin=None,
@@ -180,13 +186,41 @@ int main(void) {
 
                         build_package_dir(package_dir, "1.2.3", variant, spec, inputs)
                         validate_package_dir(package_dir, variant, spec)
+                        for suffix in (".tar.gz", ".tar.zst"):
+                            archive_path = root / f"package{suffix}"
+                            write_archive(package_dir, archive_path, force=False)
+                            data = (
+                                subprocess.check_output(
+                                    [
+                                        *resolve_zstd_command(),
+                                        "-d",
+                                        "--stdout",
+                                        str(archive_path),
+                                    ]
+                                )
+                                if suffix == ".tar.zst"
+                                else archive_path.read_bytes()
+                            )
+                            with tarfile.open(
+                                fileobj=io.BytesIO(data), mode="r:*"
+                            ) as archive:
+                                member = archive.getmember("bin/codex-exec-server")
+                                self.assertTrue(member.mode & 0o111)
+                                self.assertEqual(
+                                    archive.extractfile(member).read(),
+                                    rg_bin.read_bytes(),
+                                )
 
                         self.assertEqual(
                             {
                                 "rg": (package_dir / "codex-path" / "rg").read_bytes(),
+                                "executor": (
+                                    package_dir / "bin/codex-exec-server"
+                                ).read_bytes(),
                             },
                             {
                                 "rg": b"signed ripgrep binary",
+                                "executor": b"signed ripgrep binary",
                             },
                         )
 
@@ -198,6 +232,7 @@ int main(void) {
             inputs = PackageInputs(
                 entrypoint_bin=touch_executable(root / "codex-app-server"),
                 code_mode_host_bin=touch_executable(root / "codex-code-mode-host"),
+                exec_server_bin=touch_executable(root / "codex-exec-server"),
                 rg_bin=touch_executable(root / "rg"),
                 bwrap_bin=touch_executable(root / "bwrap"),
                 codex_command_runner_bin=None,