## Why
`rules_rust` drops the build script's per-binary linker directives, so Bazel
builds can omit the `asInvoker` manifest from the Windows sandbox setup helper.
## What changed
- Add per-binary compile data and Rust flags to `codex_rust_crate` so linker
inputs remain scoped to the setup helper.
- Embed the manifest directly for MSVC builds and compile it into a resource
with hermetic LLVM tooling for GNU/LLVM cross-builds.
- Disable the redundant build script under Bazel and avoid duplicating binary
runfiles in integration test data.
## Testing
Add a Windows integration test that loads the setup executable's manifest
resource and verifies that it requests `asInvoker` execution with UI access
disabled.
GitOrigin-RevId: a77e7e627ee43810f5eaf7701bb4909bf855216b
