Expose a stable executor build identity in environment metadata (#43513)

## Why

Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.

## What changed

- Add optional `providerId` to exec-server environment metadata, cached at startup
  and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
  standard build configuration, not exact executable bytes, and is omitted when
  the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
  metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
  Windows command-line length while preserving file order.

## Testing

Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.

GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4

codex-rs/exec-server/src/server.rs

@@ -1,3 +1,4 @@
+mod build_identity;
 mod file_system_handler;
 mod handler;
 mod process_handler;
@@ -50,6 +51,7 @@ pub async fn run_main_with_telemetry(
     http_client_factory: HttpClientFactory,
     request_dispatch_mode: RequestDispatchMode,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+    std::sync::LazyLock::force(&build_identity::PROVIDER_ID);
     transport::run_transport(
         listen_url,
         runtime_paths,