fix(ci): restore guardian coverage and bazel unit tests (#13912)

## Summary
- restore the guardian review request snapshot test and its tracked
snapshot after it was dropped from `main`
- make Bazel Rust unit-test wrappers resolve runfiles correctly on
manifest-only platforms like macOS and point Insta at the real workspace
root
- harden the shell-escalation socket-closure assertion so the musl Bazel
test no longer depends on fd reuse behavior

## Verification
- cargo test -p codex-core
guardian_review_request_layout_matches_model_visible_request_snapshot
- cargo test -p codex-shell-escalation
- bazel test //codex-rs/exec:exec-unit-tests
//codex-rs/shell-escalation:shell-escalation-unit-tests

Supersedes #13894.

---------

Co-authored-by: Ahmed Ibrahim <aibrahim@openai.com>
Co-authored-by: viyatb-oai <viyatb@openai.com>
Co-authored-by: Codex <noreply@openai.com>

workspace_root_test_launcher.bat.tpl

@@ -0,0 +1,53 @@
+@echo off
+setlocal EnableExtensions EnableDelayedExpansion
+
+call :resolve_runfile workspace_root_marker "__WORKSPACE_ROOT_MARKER__"
+if errorlevel 1 exit /b 1
+
+for %%I in ("%workspace_root_marker%") do set "workspace_root_marker_dir=%%~dpI"
+for %%I in ("%workspace_root_marker_dir%..\..") do set "workspace_root=%%~fI"
+
+call :resolve_runfile test_bin "__TEST_BIN__"
+if errorlevel 1 exit /b 1
+
+set "INSTA_WORKSPACE_ROOT=%workspace_root%"
+cd /d "%workspace_root%" || exit /b 1
+"%test_bin%" %*
+exit /b %ERRORLEVEL%
+
+:resolve_runfile
+setlocal EnableExtensions EnableDelayedExpansion
+set "logical_path=%~2"
+set "workspace_logical_path=%logical_path%"
+if defined TEST_WORKSPACE set "workspace_logical_path=%TEST_WORKSPACE%/%logical_path%"
+set "native_logical_path=%logical_path:/=\%"
+set "native_workspace_logical_path=%workspace_logical_path:/=\%"
+
+for %%R in ("%RUNFILES_DIR%" "%TEST_SRCDIR%") do (
+  set "runfiles_root=%%~R"
+  if defined runfiles_root (
+    if exist "!runfiles_root!\!native_logical_path!" (
+      endlocal & set "%~1=!runfiles_root!\!native_logical_path!" & exit /b 0
+    )
+    if exist "!runfiles_root!\!native_workspace_logical_path!" (
+      endlocal & set "%~1=!runfiles_root!\!native_workspace_logical_path!" & exit /b 0
+    )
+  )
+)
+
+set "manifest=%RUNFILES_MANIFEST_FILE%"
+if not defined manifest if exist "%~f0.runfiles_manifest" set "manifest=%~f0.runfiles_manifest"
+if not defined manifest if exist "%~dpn0.runfiles_manifest" set "manifest=%~dpn0.runfiles_manifest"
+if not defined manifest if exist "%~f0.exe.runfiles_manifest" set "manifest=%~f0.exe.runfiles_manifest"
+
+if defined manifest if exist "%manifest%" (
+  for /f "usebackq tokens=1,* delims= " %%A in (`findstr /b /c:"%logical_path% " "%manifest%"`) do (
+    endlocal & set "%~1=%%B" & exit /b 0
+  )
+  for /f "usebackq tokens=1,* delims= " %%A in (`findstr /b /c:"%workspace_logical_path% " "%manifest%"`) do (
+    endlocal & set "%~1=%%B" & exit /b 0
+  )
+)
+
+>&2 echo failed to resolve runfile: %logical_path%
+endlocal & exit /b 1