Expose a stable executor build identity in environment metadata (#43513)

## Why

Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.

## What changed

- Add optional `providerId` to exec-server environment metadata, cached at startup
  and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
  standard build configuration, not exact executable bytes, and is omitted when
  the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
  metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
  Windows command-line length while preserving file order.

## Testing

Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.

GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4

codex-rs/exec-server-protocol/src/protocol.rs

@@ -99,6 +99,12 @@ pub struct EnvironmentInfo {
     /// `0.0.0` when unknown, including responses from legacy executors.
     #[serde(default = "unknown_executor_version")]
     pub executor_version: String,
+    /// Opaque executor build identity for looking up behavioral verification.
+    /// Derived from the compiled commit and target for standard builds;
+    /// absent for legacy or unstamped builds. This is not an artifact checksum
+    /// or a security attestation, and evidence must not be shared across build variants.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub provider_id: Option<String>,
     /// Working directory inherited by the exec-server process.
     #[serde(default)]
     pub cwd: Option<PathUri>,
@@ -224,6 +230,7 @@ impl EnvironmentInfo {
         Self {
             shell: codex_shell_command::shell_detect::default_user_shell().into(),
             executor_version: unknown_executor_version(),
+            provider_id: None,
             cwd: cwd.and_then(|cwd| PathUri::from_host_native_path(cwd).ok()),
             user_home_dir: PathUri::from_host_native_path("~").ok(),
             platform_os: Some(std::env::consts::OS.to_string()),
@@ -1022,6 +1029,7 @@ mod tests {
                     path: "/bin/zsh".to_string(),
                 },
                 executor_version: "0.0.0".to_string(),
+                provider_id: None,
                 cwd: None,
                 user_home_dir: None,
                 platform_os: None,
@@ -1058,6 +1066,7 @@ mod tests {
         let expected = serde_json::json!({
             "shell": { "name": "powershell", "path": "powershell.exe" },
             "executorVersion": "1.2.3-alpha.4",
+            "providerId": "sha256:e0a0cebe63ab8189ffe3eed378ccf6aa89ef15bc75e39dbbf1fc55951ec6888b",
             "cwd": null,
             "userHomeDir": "file:///C:/Users/remote",
             "platformOs": "windows",