[codex] Make justfile recipes Windows-aware (#24983)

## Summary

Make the root `justfile` usable from Windows without maintaining a
separate Windows copy of most recipes.

The repo recipes previously assumed POSIX shell behavior for things like
variadic argument forwarding (`"$@"`) and stderr redirection
(`2>/dev/null`). That made common workflows such as `just fmt`, `just
test`, and `just log` unreliable from Windows. This PR introduces a
small cross-platform shell adapter so recipes can stay mostly unified
while still expanding the few shell-specific constructs correctly on
macOS/Linux and Windows.

## What Changed

- Add `scripts/just-shell.py` as the configured `just` shell adapter.
  - On Unix it invokes `sh -cu`.
- On Windows it invokes `pwsh -CommandWithArgs` so arguments containing
spaces are preserved.
- Add portable recipe placeholders:
- `{args}` expands to `"$@"` on Unix and the equivalent PowerShell
forwarded-args expression on Windows.
- `{stderr-null}` expands to the platform-specific stderr suppression
used by `fmt`.
- Convert most variadic one-line recipes to the unified `{args}` form,
including `codex`, `exec`, `file-search`, `app-server-test-client`,
`fix`, `clippy`, `bench`, `mcp-server-run`, `write-app-server-schema`,
and `argument-comment-lint-from-source`.
- Keep genuinely shell-specific recipes split or Unix-only for now,
including recipes backed by `.sh` scripts or recipes whose bodies are
more than simple command forwarding.
- Add a Windows `just install` path that installs PowerShell via
`winget` when `pwsh` is not available, then runs the same basic Rust
setup steps.
- Update the SDK test that validates the root `fmt` recipe so it
recognizes the new portable stderr placeholder.

## Validation

- `just --summary`
- `just --dry-run fmt`
- `just --dry-run bench-smoke`
- `just --dry-run codex foo "bar binky" baz`
- `just --dry-run write-hooks-schema`
- `just --dry-run bazel-lock-update`
- `just --dry-run argument-comment-lint-from-source -- "foo bar"`
- `git diff --check -- justfile scripts/just-shell.py
sdk/python/tests/test_artifact_workflow_and_binaries.py`
- Verified Windows argv preservation through `scripts/just-shell.py`
with arguments containing spaces.
- `uv run --frozen --project sdk/python --extra dev pytest
sdk/python/tests/test_artifact_workflow_and_binaries.py::test_root_fmt_recipe_formats_rust_and_python_sdk`

scripts/just-shell.py

@@ -0,0 +1,72 @@
+#!/usr/bin/env python3
+"""Cross-platform shell launcher for `just` recipes.
+
+This keeps recipe bodies as normal shell snippets while giving the justfile one
+portable placeholder, `{args}`, for forwarding variadic recipe arguments.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import subprocess
+import sys
+
+
+ARGS_TOKEN = "{args}"
+STDERR_NULL_TOKEN = "{stderr-null}"
+POWERSHELL_ARGS = "@($args | Select-Object -Skip 1)"
+POWERSHELL_STDERR_NULL = '2>$null; exit $LASTEXITCODE'
+SH_ARGS = '"$@"'
+SH_STDERR_NULL = "2>/dev/null"
+
+
+def main() -> int:
+    if len(sys.argv) < 2:
+        print("just shell adapter expected a recipe command.", file=sys.stderr)
+        return 1
+
+    command = sys.argv[1]
+    recipe_name = sys.argv[2] if len(sys.argv) > 2 else ""
+    recipe_args = sys.argv[3:]
+
+    if os.name == "nt":
+        return run_powershell(command, recipe_name, recipe_args)
+    else:
+        return run_sh(command, recipe_name, recipe_args)
+
+
+def run_sh(command: str, recipe_name: str, recipe_args: list[str]) -> int:
+    command = command.replace(ARGS_TOKEN, SH_ARGS)
+    command = command.replace(STDERR_NULL_TOKEN, SH_STDERR_NULL)
+    os.execvp("sh", ["sh", "-cu", command, recipe_name, *recipe_args])
+
+
+def run_powershell(command: str, recipe_name: str, recipe_args: list[str]) -> int:
+    pwsh = shutil.which("pwsh.exe") or shutil.which("pwsh")
+    if pwsh is None:
+        print(
+            "PowerShell ('pwsh') is required for Windows just recipes. "
+            "Run 'just install' to install it.",
+            file=sys.stderr,
+        )
+        return 1
+
+    command = command.replace(ARGS_TOKEN, POWERSHELL_ARGS)
+    command = command.replace(STDERR_NULL_TOKEN, POWERSHELL_STDERR_NULL)
+    return subprocess.run(
+        [
+            pwsh,
+            "-NoLogo",
+            "-NoProfile",
+            "-CommandWithArgs",
+            command,
+            recipe_name,
+            *recipe_args,
+        ],
+        check=False,
+    ).returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())