## Why
Cargo and Bazel embed different PDB filenames in the Windows code-mode host executable. The package smoke test must support both names while verifying that the debug symbols match the packaged executable.
## What changed
- Keep the archived PDB and copy it to `codex_code_mode_host.pdb`, allowing `dumpbin /PDBPATH` to resolve either name. Accept either path in the assertion.
- Set `sandbox_workspace_write.writable_roots = []` explicitly in the smoke-test configuration.
GitOrigin-RevId: fc2610f580dad49e38848582bc63f1f829cb766d