[codex] Remove async_trait from first-party code (#27475)

## Why

First-party async traits should expose their `Send` contracts explicitly
without requiring `async_trait`. This completes the migration pattern
established in #27303 and #27304.

## What changed

- Replaced the remaining first-party `async_trait` traits with native
return-position `impl Future + Send` where statically dispatched and
explicit boxed `Send` futures where object safety is required.
- Kept implementations behavior-preserving, outlining existing async
bodies into inherent methods where that keeps the diff reviewable.
- Removed all direct first-party `async-trait` dependencies and the
workspace dependency declaration.
- Added a cargo-deny policy that permits `async-trait` only through the
remaining transitive wrapper crates.
- Updated `rand` from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097 and
keep the full cargo-deny check passing.

## Validation

- `just test -p codex-exec-server`: 216 passed, 2 skipped.
- `just test -p codex-model-provider`: 39 passed.
- `just test -p codex-core` and `just test`: changed tests passed;
remaining failures are environment-sensitive suites unrelated to this
migration.
- `cargo deny check`
- `just fix`
- `just fmt`
- `cargo shear`
- `just bazel-lock-check`

codex-rs/exec-server/src/remote_process.rs

@@ -1,13 +1,13 @@
 use std::sync::Arc;
 
-use async_trait::async_trait;
 use tokio::sync::watch;
 use tracing::trace;
 
 use crate::ExecBackend;
+use crate::ExecBackendFuture;
 use crate::ExecProcess;
 use crate::ExecProcessEventReceiver;
-use crate::ExecServerError;
+use crate::ExecProcessFuture;
 use crate::StartedExecProcess;
 use crate::client::LazyRemoteExecServerClient;
 use crate::client::Session;
@@ -30,11 +30,11 @@ impl RemoteProcess {
         trace!("remote process new");
         Self { client }
     }
-}
 
-#[async_trait]
-impl ExecBackend for RemoteProcess {
-    async fn start(&self, params: ExecParams) -> Result<StartedExecProcess, ExecServerError> {
+    async fn start(
+        &self,
+        params: ExecParams,
+    ) -> Result<StartedExecProcess, crate::ExecServerError> {
         let process_id = params.process_id.clone();
         let client = self.client.get().await?;
         let session = client.register_session(&process_id).await?;
@@ -49,7 +49,38 @@ impl ExecBackend for RemoteProcess {
     }
 }
 
-#[async_trait]
+impl ExecBackend for RemoteProcess {
+    fn start(&self, params: ExecParams) -> ExecBackendFuture<'_> {
+        Box::pin(RemoteProcess::start(self, params))
+    }
+}
+
+impl RemoteExecProcess {
+    async fn read(
+        &self,
+        after_seq: Option<u64>,
+        max_bytes: Option<usize>,
+        wait_ms: Option<u64>,
+    ) -> Result<ReadResponse, crate::ExecServerError> {
+        self.session.read(after_seq, max_bytes, wait_ms).await
+    }
+
+    async fn write(&self, chunk: Vec<u8>) -> Result<WriteResponse, crate::ExecServerError> {
+        trace!("exec process write");
+        self.session.write(chunk).await
+    }
+
+    async fn signal(&self, signal: ProcessSignal) -> Result<(), crate::ExecServerError> {
+        trace!("exec process signal");
+        self.session.signal(signal).await
+    }
+
+    async fn terminate(&self) -> Result<(), crate::ExecServerError> {
+        trace!("exec process terminate");
+        self.session.terminate().await
+    }
+}
+
 impl ExecProcess for RemoteExecProcess {
     fn process_id(&self) -> &crate::ProcessId {
         self.session.process_id()
@@ -63,28 +94,25 @@ impl ExecProcess for RemoteExecProcess {
         self.session.subscribe_events()
     }
 
-    async fn read(
+    fn read(
         &self,
         after_seq: Option<u64>,
         max_bytes: Option<usize>,
         wait_ms: Option<u64>,
-    ) -> Result<ReadResponse, ExecServerError> {
-        self.session.read(after_seq, max_bytes, wait_ms).await
+    ) -> ExecProcessFuture<'_, ReadResponse> {
+        Box::pin(RemoteExecProcess::read(self, after_seq, max_bytes, wait_ms))
     }
 
-    async fn write(&self, chunk: Vec<u8>) -> Result<WriteResponse, ExecServerError> {
-        trace!("exec process write");
-        self.session.write(chunk).await
+    fn write(&self, chunk: Vec<u8>) -> ExecProcessFuture<'_, WriteResponse> {
+        Box::pin(RemoteExecProcess::write(self, chunk))
     }
 
-    async fn signal(&self, signal: ProcessSignal) -> Result<(), ExecServerError> {
-        trace!("exec process signal");
-        self.session.signal(signal).await
+    fn signal(&self, signal: ProcessSignal) -> ExecProcessFuture<'_, ()> {
+        Box::pin(RemoteExecProcess::signal(self, signal))
     }
 
-    async fn terminate(&self) -> Result<(), ExecServerError> {
-        trace!("exec process terminate");
-        self.session.terminate().await
+    fn terminate(&self) -> ExecProcessFuture<'_, ()> {
+        Box::pin(RemoteExecProcess::terminate(self))
     }
 }