Remove Windows sandbox resource stamping (#23764)

## Why

The `codex-windows-sandbox` crate was embedding Windows resource
metadata through a package-level `build.rs`. Because that package also
exposes the `codex_windows_sandbox` library, downstream binaries that
link the library could inherit `FileDescription` / `ProductName` values
of `codex-windows-sandbox`.

That made ordinary Codex binaries, including the long-lived `codex.exe`
app-server sidecar, appear as `codex-windows-sandbox` in Windows UI
surfaces such as Task Manager / file properties.

We do not rely on this metadata enough to justify a larger bin-only
resource split, so this removes the resource stamping entirely.

## What changed

- Removed the `windows-sandbox-rs` build script that invoked `winres`.
- Removed the setup manifest that was only consumed by that build
script.
- Removed the `winres` build dependency and corresponding `Cargo.lock` /
`MODULE.bazel.lock` entries.
- Removed the now-unused Bazel build-script data.

## Verification

- `cargo build -p codex-windows-sandbox --bins`
- `cargo build -p codex-cli --bin codex`
- `bazel mod deps --lockfile_mode=update` via Bazelisk, with local
remote-cache-disabling flags because `bazel` is not installed on PATH
here
- `bazel mod deps --lockfile_mode=error` via Bazelisk, with the same
local flags
- Verified rebuilt `codex.exe`, `codex-command-runner.exe`, and
`codex-windows-sandbox-setup.exe` now have blank `FileDescription` /
`ProductName` fields.
- `cargo test -p codex-windows-sandbox` still fails on two legacy
Windows sandbox tests with `CreateRestrictedToken failed: 87` and the
follow-on poisoned test lock; 85 passed, 2 ignored.

codex-rs/Cargo.lock

@@ -4142,7 +4142,6 @@ dependencies = [
  "tokio",
  "windows 0.58.0",
  "windows-sys 0.52.0",
- "winres",
 ]
 
 [[package]]
@@ -14727,15 +14726,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "winres"
-version = "0.1.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b68db261ef59e9e52806f688020631e987592bd83619edccda9c47d42cde4f6c"
-dependencies = [
- "toml 0.5.11",
-]
-
 [[package]]
 name = "winsafe"
 version = "0.0.19"

codex-rs/windows-sandbox-rs/BUILD.bazel

@@ -3,8 +3,4 @@ load("//:defs.bzl", "codex_rust_crate")
 codex_rust_crate(
     name = "windows-sandbox-rs",
     crate_name = "codex_windows_sandbox",
-    build_script_data = [
-        "Cargo.toml",
-        "codex-windows-sandbox-setup.manifest",
-    ],
 )

codex-rs/windows-sandbox-rs/Cargo.toml

@@ -1,5 +1,4 @@
 [package]
-build = "build.rs"
 edition.workspace = true
 license.workspace = true
 name = "codex-windows-sandbox"
@@ -93,6 +92,3 @@ version = "0.52"
 
 [dev-dependencies]
 pretty_assertions = { workspace = true }
-
-[build-dependencies]
-winres = "0.1"

codex-rs/windows-sandbox-rs/build.rs

@@ -1,15 +0,0 @@
-fn main() {
-    if std::env::var_os("RULES_RUST_BAZEL_BUILD_SCRIPT_RUNNER").is_some()
-        && matches!(std::env::var("CARGO_CFG_TARGET_ENV").as_deref(), Ok("gnu"))
-    {
-        // The Windows Bazel lint/test lane targets `windows-gnullvm`, where
-        // `winres` can emit a `resource` link directive without a usable
-        // archive in `OUT_DIR`. Skip embedding the manifest there; Cargo's
-        // normal MSVC builds still compile it.
-        return;
-    }
-
-    let mut res = winres::WindowsResource::new();
-    res.set_manifest_file("codex-windows-sandbox-setup.manifest");
-    let _ = res.compile();
-}

codex-rs/windows-sandbox-rs/codex-windows-sandbox-setup.manifest

@@ -1,10 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
-<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
-  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
-    <security>
-      <requestedPrivileges>
-        <requestedExecutionLevel level="asInvoker" uiAccess="false"/>
-      </requestedPrivileges>
-    </security>
-  </trustInfo>
-</assembly>