packaging: move rg manifest out of npm bin (#23833)

## Why

Installing `@openai/codex` currently places a Dotslash `rg` manifest at
`node_modules/@openai/codex/bin/rg`, even though the native optional
dependency already ships the actual helper under
`vendor/<target>/codex-path/rg`. The launcher prepends that `codex-path`
directory, so the top-level `bin/rg` file is redundant in the npm
install.

The remaining direct consumers of the manifest are package-building
paths: `scripts/codex_package/ripgrep.py` and
`codex-cli/scripts/install_native_deps.py`. Keeping the manifest under
`codex-cli/bin` makes it look like a shipped npm binary, so this moves
it next to the package-builder code that owns it. The checked-in
`@openai/codex` package metadata should likewise describe only the meta
package payload; generated platform packages continue to publish
`vendor`.

## What Changed

- Moved the Dotslash ripgrep manifest from `codex-cli/bin/rg` to
`scripts/codex_package/rg`.
- Updated the package builder, npm native-artifact hydrator, README, and
CLI help text to reference the new manifest location.
- Stopped `codex-cli/scripts/build_npm_package.py` from copying `rg`
into the `@openai/codex` meta package.
- Narrowed the checked-in meta package `files` whitelist to
`bin/codex.js`.

## Verification

- `python3 -m unittest discover -s scripts/codex_package -p "test_*.py"`
- `python3 -m unittest discover -s codex-cli/scripts -p "test_*.py"`
- `python3 -m py_compile codex-cli/scripts/build_npm_package.py
codex-cli/scripts/install_native_deps.py
scripts/codex_package/ripgrep.py scripts/codex_package/cli.py
scripts/stage_npm_packages.py`
- `codex-cli/scripts/build_npm_package.py --package codex --version
0.0.0-test --pack-output <tmp>/codex-meta-no-vendor.tgz`
- `tar -tf <tmp>/codex-meta-no-vendor.tgz` showed only
`package/bin/codex.js`, `package/package.json`, and `package/README.md`.
- Direct staging check showed `codex` uses `files: ["bin/codex.js"]`
while `codex-darwin-arm64` still uses `files: ["vendor"]`.

---
[//]: # (BEGIN SAPLING FOOTER)
Stack created with [Sapling](https://sapling-scm.com). Best reviewed
with [ReviewStack](https://reviewstack.dev/openai/codex/pull/23833).
* #23836
* __->__ #23833

scripts/codex_package/README.md

@@ -56,7 +56,7 @@ Windows packages. This keeps package archive creation as a pure staging step
 after signing instead of rebuilding resources.
 
 `rg` is not built from this repository, so the builder fetches it from the
-DotSlash manifest at `codex-cli/bin/rg`. Downloaded archives are cached under
-`$TMPDIR/codex-package/<target>-rg` and are reused only after the recorded size
-and SHA-256 digest have been verified. Pass `--rg-bin` to use a local ripgrep
-executable instead.
+DotSlash manifest at `scripts/codex_package/rg`. Downloaded archives are cached
+under `$TMPDIR/codex-package/<target>-rg` and are reused only after the recorded
+size and SHA-256 digest have been verified. Pass `--rg-bin` to use a local
+ripgrep executable instead.

scripts/codex_package/cli.py

@@ -114,7 +114,7 @@ def parse_args() -> argparse.Namespace:
         type=Path,
         help=(
             "Optional local ripgrep executable override instead of fetching from "
-            "codex-cli/bin/rg."
+            "scripts/codex_package/rg."
         ),
     )
     return parser.parse_args()

scripts/codex_package/rg

@@ -0,0 +1,79 @@
+#!/usr/bin/env dotslash
+
+{
+  "name": "rg",
+  "platforms": {
+    "macos-aarch64": {
+      "size": 1777930,
+      "hash": "sha256",
+      "digest": "378e973289176ca0c6054054ee7f631a065874a352bf43f0fa60ef079b6ba715",
+      "format": "tar.gz",
+      "path": "ripgrep-15.1.0-aarch64-apple-darwin/rg",
+      "providers": [
+        {
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-aarch64-apple-darwin.tar.gz"
+        }
+      ]
+    },
+    "linux-aarch64": {
+      "size": 1869959,
+      "hash": "sha256",
+      "digest": "2b661c6ef508e902f388e9098d9c4c5aca72c87b55922d94abdba830b4dc885e",
+      "format": "tar.gz",
+      "path": "ripgrep-15.1.0-aarch64-unknown-linux-gnu/rg",
+      "providers": [
+        {
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-aarch64-unknown-linux-gnu.tar.gz"
+        }
+      ]
+    },
+    "macos-x86_64": {
+      "size": 1894127,
+      "hash": "sha256",
+      "digest": "64811cb24e77cac3057d6c40b63ac9becf9082eedd54ca411b475b755d334882",
+      "format": "tar.gz",
+      "path": "ripgrep-15.1.0-x86_64-apple-darwin/rg",
+      "providers": [
+        {
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-x86_64-apple-darwin.tar.gz"
+        }
+      ]
+    },
+    "linux-x86_64": {
+      "size": 2263077,
+      "hash": "sha256",
+      "digest": "1c9297be4a084eea7ecaedf93eb03d058d6faae29bbc57ecdaf5063921491599",
+      "format": "tar.gz",
+      "path": "ripgrep-15.1.0-x86_64-unknown-linux-musl/rg",
+      "providers": [
+        {
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-x86_64-unknown-linux-musl.tar.gz"
+        }
+      ]
+    },
+    "windows-x86_64": {
+      "size": 1810687,
+      "hash": "sha256",
+      "digest": "124510b94b6baa3380d051fdf4650eaa80a302c876d611e9dba0b2e18d87493a",
+      "format": "zip",
+      "path": "ripgrep-15.1.0-x86_64-pc-windows-msvc/rg.exe",
+      "providers": [
+        {
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-x86_64-pc-windows-msvc.zip"
+        }
+      ]
+    },
+    "windows-aarch64": {
+      "size": 1675460,
+      "hash": "sha256",
+      "digest": "00d931fb5237c9696ca49308818edb76d8eb6fc132761cb2a1bd616b2df02f8e",
+      "format": "zip",
+      "path": "ripgrep-15.1.0-aarch64-pc-windows-msvc/rg.exe",
+      "providers": [
+        {
+          "url": "https://github.com/BurntSushi/ripgrep/releases/download/15.1.0/ripgrep-15.1.0-aarch64-pc-windows-msvc.zip"
+        }
+      ]
+    }
+  }
+}

scripts/codex_package/ripgrep.py

@@ -1,4 +1,4 @@
-"""Fetch ripgrep from the DotSlash manifest used by the npm package."""
+"""Fetch ripgrep from the DotSlash manifest used by the package builder."""
 
 import hashlib
 import json
@@ -17,7 +17,7 @@ from .targets import TargetSpec
 from .targets import resolve_input_path
 
 
-RG_MANIFEST = REPO_ROOT / "codex-cli" / "bin" / "rg"
+RG_MANIFEST = REPO_ROOT / "scripts" / "codex_package" / "rg"
 DOWNLOAD_TIMEOUT_SECS = 60