Ship codex-exec-server in CLI and app-server packages (#57590)

## What changed

- Build and bundle the standalone executor in `bin/` for both package variants, and advertise its path through `execServer` in `codex-package.json`.
- Include the executor in Cargo and Bazel release packaging, macOS signing and notarization, and Windows signing verification. Preserve prebuilt signed binaries during packaging.
- Make installers detect a missing advertised executor while continuing to accept older packages without it.

## Testing

Add coverage for executor archive contents and executable permissions, signed binary preservation, and macOS entitlement verification. Add package smoke tests for initialization, version reporting, filesystem and process sandbox enforcement, and startup error parity with `codex exec-server`.

GitOrigin-RevId: 5c0027fc19f16cf9c2a5bb52dbd065a9776bc2af

scripts/install/install.ps1

@@ -772,6 +772,16 @@ function Test-PackageContentsAreComplete {
         "codex-resources\codex-command-runner.exe",
         "codex-resources\codex-windows-sandbox-setup.exe"
     )
+    try {
+        $metadataPath = $ExecutionContext.SessionState.Path.GetUnresolvedProviderPathFromPSPath((Join-Path $PackageDir "codex-package.json"))
+        $metadata = [System.IO.File]::ReadAllText($metadataPath)
+        # Older canonical packages do not advertise or contain the executor.
+        if ([regex]::IsMatch($metadata, '"execServer"\s*:')) {
+            $expectedFiles += "bin\codex-exec-server.exe"
+        }
+    } catch {
+        return $false
+    }
     foreach ($name in $expectedFiles) {
         if (-not (Test-Path -LiteralPath (Join-Path $PackageDir $name) -PathType Leaf)) {
             return $false

scripts/install/install.sh

@@ -1125,6 +1125,9 @@ install_package_release() {
   if [ -f "$stage_release/codex-resources/bwrap" ]; then
     chmod 0755 "$stage_release/codex-resources/bwrap"
   fi
+  if [ -f "$stage_release/bin/codex-exec-server" ]; then
+    chmod 0755 "$stage_release/bin/codex-exec-server"
+  fi
   ln -sf "bin/codex" "$stage_release/codex"
 
   if [ -e "$release_dir" ] || [ -L "$release_dir" ]; then
@@ -1178,6 +1181,10 @@ release_dir_is_complete() {
         [ -x "$release_dir/codex" ] &&
         [ -x "$release_dir/codex-path/rg" ] ||
         return 1
+      # Older canonical packages do not advertise or contain the executor.
+      if grep -Eq '"execServer"[[:space:]]*:' "$release_dir/codex-package.json"; then
+        [ -x "$release_dir/bin/codex-exec-server" ] || return 1
+      fi
       ;;
     legacy-platform-npm)
       [ -x "$release_dir/codex" ] &&

scripts/install/test_install_sh.py

@@ -995,6 +995,7 @@ def run_installer_in(
     root: Path,
     release: str,
     *,
+    installer_path: Path = INSTALL_SCRIPT,
     metadata_failure: bool = False,
     metadata_json: str | None = None,
     releases_metadata_json: str | None = None,
@@ -1186,7 +1187,7 @@ def run_installer_in(
             "TRUE" if use_mirror else "false"
         )
     result = subprocess.run(
-        ["/bin/sh", str(INSTALL_SCRIPT)],
+        ["/bin/sh", str(installer_path)],
         capture_output=True,
         check=False,
         env=env,
@@ -1213,14 +1214,17 @@ def create_package_release(
     metadata_version: str = VERSION,
     binary_version: str = VERSION,
     target: str = "aarch64-apple-darwin",
+    include_exec_server: bool = False,
 ) -> tuple[Path, Path, str]:
     package_dir = root / "package"
     (package_dir / "bin").mkdir(parents=True)
     (package_dir / "codex-path").mkdir()
+    metadata = {"version": binary_version, "target": target, "entrypoint": "bin/codex"}
+    if include_exec_server:
+        metadata["execServer"] = "bin/codex-exec-server"
+        write_executable(package_dir / "bin/codex-exec-server", "#!/bin/sh\nexit 0\n")
     (package_dir / "codex-package.json").write_text(
-        json.dumps(
-            {"version": binary_version, "target": target, "entrypoint": "bin/codex"}
-        ),
+        json.dumps(metadata),
         encoding="utf-8",
     )
     write_executable(