fix(ci): restore guardian coverage and bazel unit tests (#13912)

## Summary
- restore the guardian review request snapshot test and its tracked
snapshot after it was dropped from `main`
- make Bazel Rust unit-test wrappers resolve runfiles correctly on
manifest-only platforms like macOS and point Insta at the real workspace
root
- harden the shell-escalation socket-closure assertion so the musl Bazel
test no longer depends on fd reuse behavior

## Verification
- cargo test -p codex-core
guardian_review_request_layout_matches_model_visible_request_snapshot
- cargo test -p codex-shell-escalation
- bazel test //codex-rs/exec:exec-unit-tests
//codex-rs/shell-escalation:shell-escalation-unit-tests

Supersedes #13894.

---------

Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>
Co-authored-by: viyatb-oai <viyatb@openai.com>
Co-authored-by: Codex <noreply@openai.com>

codex-rs/shell-escalation/src/unix/escalate_server.rs

@@ -398,6 +398,7 @@ mod tests {
     use codex_utils_absolute_path::AbsolutePathBuf;
     use pretty_assertions::assert_eq;
     use std::collections::HashMap;
+    use std::os::fd::AsRawFd;
     use std::os::fd::FromRawFd;
     use std::path::PathBuf;
     use std::sync::LazyLock;
@@ -558,8 +559,19 @@ mod tests {
                 .expect("session should export shell escalation socket")
                 .parse::<i32>()?;
             assert_ne!(unsafe { libc::fcntl(socket_fd, libc::F_GETFD) }, -1);
+            let preserved_socket_fd = unsafe { libc::dup(socket_fd) };
+            assert!(
+                preserved_socket_fd >= 0,
+                "expected dup() of client socket to succeed",
+            );
+            let preserved_socket =
+                unsafe { std::os::fd::OwnedFd::from_raw_fd(preserved_socket_fd) };
             after_spawn.expect("one-shot exec should install an after-spawn hook")();
-            assert_eq!(unsafe { libc::fcntl(socket_fd, libc::F_GETFD) }, -1);
+            let replacement_fd =
+                unsafe { libc::fcntl(preserved_socket.as_raw_fd(), libc::F_DUPFD, socket_fd) };
+            assert_eq!(replacement_fd, socket_fd);
+            let replacement_socket = unsafe { std::os::fd::OwnedFd::from_raw_fd(replacement_fd) };
+            drop(replacement_socket);
             Ok(ExecResult {
                 exit_code: 0,
                 stdout: String::new(),