[codex] Fix current main CI blockers (#17917)

## Summary
- Fix marketplace-add local path detection on Windows by using
`Path::is_absolute()`.
- Make marketplace-add local-source tests parse/write TOML through the
same helpers instead of raw string matching.
- Update `rand` 0.9.x to 0.9.3 and document the remaining audited `rand`
0.8.5 advisory exception.
- Refresh `MODULE.bazel.lock` after the Cargo.lock update.

## Why
Latest `main` had two independent CI blockers: marketplace-add tests
were not portable to Windows path/TOML escaping, and cargo-deny still
reported `RUSTSEC-2026-0097` after the recent rustls-webpki fix.

## Validation
- `cargo test -p codex-core marketplace_add -- --nocapture`
- `cargo deny --all-features check`
- `just bazel-lock-check`
- `just fix -p codex-core`
- `just fmt`
- `git diff --check`

codex-rs/core/src/plugins/marketplace_add.rs

@@ -275,9 +275,15 @@ mod tests {
         );
 
         let config = fs::read_to_string(codex_home.path().join(codex_config::CONFIG_TOML_FILE))?;
-        assert!(config.contains("[marketplaces.debug]"));
-        assert!(config.contains("source_type = \"local\""));
-        assert!(config.contains(&format!("source = \"{expected_source}\"")));
+        let config: toml::Value = toml::from_str(&config)?;
+        assert_eq!(
+            config["marketplaces"]["debug"]["source_type"].as_str(),
+            Some("local")
+        );
+        assert_eq!(
+            config["marketplaces"]["debug"]["source"].as_str(),
+            Some(expected_source.as_str())
+        );
         Ok(())
     }
 

codex-rs/core/src/plugins/marketplace_add/metadata.rs

@@ -296,19 +296,11 @@ mod tests {
             r#"{"name":"debug","plugins":[]}"#,
         )
         .unwrap();
-        fs::write(
-            codex_home.path().join(CONFIG_TOML_FILE),
-            format!(
-                "[marketplaces.debug]\nsource_type = \"local\"\nsource = \"{}\"\n",
-                source_root.display()
-            ),
-        )
-        .unwrap();
-
         let source = MarketplaceSource::Local {
             path: source_root.clone(),
         };
         let install_metadata = MarketplaceInstallMetadata::from_source(&source, &[]);
+        record_added_marketplace_entry(codex_home.path(), "debug", &install_metadata).unwrap();
 
         let root = installed_marketplace_root_for_source(
             codex_home.path(),

codex-rs/core/src/plugins/marketplace_add/source.rs

@@ -124,9 +124,9 @@ fn normalize_git_url(url: &str) -> String {
 }
 
 fn looks_like_local_path(source: &str) -> bool {
-    source.starts_with("./")
+    Path::new(source).is_absolute()
+        || source.starts_with("./")
         || source.starts_with("../")
-        || source.starts_with('/')
         || source.starts_with("~/")
         || source == "."
         || source == ".."