## Why
Concurrent Linux test spawns can inherit writable descriptors for executable fixtures, preventing those fixtures from being executed even after the writing test closes its descriptor.
## What changed
Replace direct executable fixture writes and copies across the Rust tests with `codex_utils_cargo_bin::write_executable` and `copy_executable`. These existing helpers complete writes and copies in separate processes on Linux.
Remove the empty temporary inode before creating fake bubblewrap executables, and stage tampered bubblewrap bytes in a separate data file before copying them into the executable fixture. Add the required test dependencies.
GitOrigin-RevId: c875c83088731a4933ef1574e8d79d8cecc12f54
## Why
Copying executable fixtures in the test process can expose writable file descriptors to sibling spawns. The shared `copy_executable` helper completes copies in a separate process on Linux before launching the fixtures.
## What changed
Use `copy_executable` for both `codex-linux-sandbox` and `bwrap` in `bazel_build_rejects_tampered_bundled_bwrap`, and add `codex-utils-cargo-bin` as a Linux test dependency.
GitOrigin-RevId: 05fb1381eeefb64568b525925c9e81863acc2b54
## Why
Bazel builds did not embed the SHA-256 digest used to verify the bundled
`bwrap` binary at launch.
## What changed
- Strip the Bazel-built `bwrap`, generate its SHA-256 digest, and pass that
digest to `codex-linux-sandbox` through a compiler environment file.
- Report digest verification failures with exit code `8` instead of panicking.
- Add a Bazel integration test that accepts the original bundled binary and
rejects a tampered copy.
GitOrigin-RevId: 224eeb6ae3d1bfb100e048b296f75fd8ba109581
jif