## What changed
- Update the workspace, Bazel toolchain and lockfile, CI and release workflows, and Windows setup script from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to the updated toolchain and Clippy lints, including `try_update` for atomics, `as_chunks` for fixed-size slices, and targeted allowances for generated tonic services.
- Refresh the halfwidth sound mark rendering snapshot to use literal characters in debug output.
GitOrigin-RevId: 5852029f687436dc814c2bca68141ee1f4a67d49
## What changed
- Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials.
- Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits.
- Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases.
- Add a `Bazel result` check for the full workflow and extend Bazel job timeouts.
## Testing
Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes.
GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
- Update Cargo and Bazel toolchain pins, CI and release workflows, and Windows setup from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to updated APIs and lint requirements, including `try_update` and `as_chunks`, and refresh the halfwidth sound marks snapshot.
- Update `webpki-root-certs` from `1.0.5` to `1.0.10` in the Cargo and Bazel lockfiles.
GitOrigin-RevId: e1aaed63b7e72bb8c8bbe25b32c6329c9a37b6c3
## What changed
Add a `build-system` input to `build-codex-packages`, defaulting to `cargo`, and extract binary builds into dedicated Cargo and Bazel actions. The Bazel path stages binaries and symbols for the shared CLI and app-server packaging and smoke-test steps, with support for `release` and `debug` build modes.
Resolve the package source root before invoking nested actions, and use Bash to export the Bazel repository cache path.
GitOrigin-RevId: ebd5e7c84451733419838da5956dc090cd09b19a
ioanbudea-OAI