Fix Windows PTY teardown by preserving ConPTY ownership (#20685)

## Why

On Windows, background terminals could stay visible after their shell
process had already exited. The elevated runner waits for the PTY output
reader to reach EOF before it sends the final exit message, but the
ConPTY helper was reducing ownership down to raw handles too early. That
left the pseudoconsole's borrowed pipe handles alive past teardown, so
EOF never propagated and the session stayed `running`.

## What changed

- change `utils/pty/src/win/conpty.rs` to hand off owned ConPTY
resources instead of leaking only raw handles
- make `windows-sandbox-rs/src/conpty/mod.rs` keep the pseudoconsole
owner and the backing pipe handles together until teardown
- update the elevated runner and the legacy unified-exec backend to keep
that `ConptyInstance` alive, take only the specific pipe handles they
need, and drop the owner at teardown instead of trying to close a
detached pseudoconsole handle later

## Testing

- desktop app in `Auto-review`: 11 x `cmd /c "ping -n 3 google.com"` all
exited cleanly and did not accumulate in the UI
- desktop app in `Auto-review`: 5 x `cmd /c "ping -n 30 google.com"`
appeared in the UI and drained back out on their own

codex-rs/utils/pty/src/lib.rs

@@ -34,4 +34,6 @@ pub use pty::conpty_supported;
 /// Spawn a process attached to a PTY for interactive use.
 pub use pty::spawn_process as spawn_pty_process;
 #[cfg(windows)]
+pub use win::PsuedoCon;
+#[cfg(windows)]
 pub use win::conpty::RawConPty;

codex-rs/utils/pty/src/win/conpty.rs

@@ -30,8 +30,8 @@ use portable_pty::PtySystem;
 use portable_pty::SlavePty;
 use portable_pty::cmdbuilder::CommandBuilder;
 use std::mem::ManuallyDrop;
-use std::os::windows::io::AsRawHandle;
 use std::os::windows::io::RawHandle;
+use std::ptr;
 use std::sync::Arc;
 use std::sync::Mutex;
 use winapi::um::wincon::COORD;
@@ -82,13 +82,15 @@ impl RawConPty {
         self.con.raw_handle()
     }
 
-    pub fn into_raw_handles(self) -> (RawHandle, RawHandle, RawHandle) {
+    pub fn into_handles(self) -> (PsuedoCon, FileDescriptor, FileDescriptor) {
         let me = ManuallyDrop::new(self);
-        (
-            me.con.raw_handle(),
-            me.input_write.as_raw_handle(),
-            me.output_read.as_raw_handle(),
-        )
+        unsafe {
+            (
+                ptr::read(&me.con),
+                ptr::read(&me.input_write),
+                ptr::read(&me.output_read),
+            )
+        }
     }
 }
 

codex-rs/utils/pty/src/win/mod.rs

@@ -49,6 +49,7 @@ mod procthreadattr;
 mod psuedocon;
 
 pub use conpty::ConPtySystem;
+pub use psuedocon::PsuedoCon;
 pub use psuedocon::conpty_supported;
 
 #[derive(Debug)]