[codex] Remove async_trait from first-party code (#27475)

## Why

First-party async traits should expose their `Send` contracts explicitly
without requiring `async_trait`. This completes the migration pattern
established in #27303 and #27304.

## What changed

- Replaced the remaining first-party `async_trait` traits with native
return-position `impl Future + Send` where statically dispatched and
explicit boxed `Send` futures where object safety is required.
- Kept implementations behavior-preserving, outlining existing async
bodies into inherent methods where that keeps the diff reviewable.
- Removed all direct first-party `async-trait` dependencies and the
workspace dependency declaration.
- Added a cargo-deny policy that permits `async-trait` only through the
remaining transitive wrapper crates.
- Updated `rand` from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097 and
keep the full cargo-deny check passing.

## Validation

- `just test -p codex-exec-server`: 216 passed, 2 skipped.
- `just test -p codex-model-provider`: 39 passed.
- `just test -p codex-core` and `just test`: changed tests passed;
remaining failures are environment-sensitive suites unrelated to this
migration.
- `cargo deny check`
- `just fix`
- `just fmt`
- `cargo shear`
- `just bazel-lock-check`

codex-rs/async-utils/src/lib.rs

@@ -1,4 +1,3 @@
-use async_trait::async_trait;
 use std::future::Future;
 use tokio_util::sync::CancellationToken;
 
@@ -7,14 +6,15 @@ pub enum CancelErr {
     Cancelled,
 }
 
-#[async_trait]
 pub trait OrCancelExt: Sized {
     type Output;
 
-    async fn or_cancel(self, token: &CancellationToken) -> Result<Self::Output, CancelErr>;
+    fn or_cancel(
+        self,
+        token: &CancellationToken,
+    ) -> impl Future<Output = Result<Self::Output, CancelErr>> + Send;
 }
 
-#[async_trait]
 impl<F> OrCancelExt for F
 where
     F: Future + Send,