Enable V8 sandboxing for source-built builds (#21146)

## Summary

This is the first PR in the V8 in-process sandboxing rollout.

It adds the build-system and Rust feature plumbing needed to support
sandboxed V8 builds, then enables sandboxing by default for the
source-built Bazel V8 path that we control directly. It deliberately
keeps the published `rusty_v8` artifact workflows on their current
non-sandboxed contract so this PR can land and ship independently before
we change any released artifacts.

## Rollout plan

- [x] **PR 1: land sandbox plumbing and default source-built Bazel V8 to
sandboxed mode**

- [ ] **PR 2: publish sandbox-enabled release artifacts and add
compatibility validation**
- Produce sandboxed artifact pairs for every released Cargo target that
does not already use the source-built Bazel path.
- Add CI coverage that consumes those sandboxed artifacts and verifies:
    - `codex-v8-poc` reports sandbox enabled
    - `codex-code-mode` builds/tests against the sandboxed path

- [ ] **PR 3: switch release consumers to sandboxed artifacts by
default**
  - Update released artifact selectors/checksums.
- Enable the Rust `v8_enable_sandbox` feature in the default release
path.
- Make the sandboxed artifact family the normal path for published
builds.

- [ ] **PR 4: remove rollout-only compatibility paths**
- Remove the temporary non-sandbox release compatibility config once the
new default has shipped and baked.
  - Keep the invariant tests permanently.

codex-rs/v8-poc/src/lib.rs

@@ -12,6 +12,17 @@ pub fn embedded_v8_version() -> &'static str {
     v8::V8::get_version()
 }
 
+/// Returns whether the linked V8 library was built with the in-process sandbox.
+#[must_use]
+pub fn linked_v8_has_sandbox() -> bool {
+    unsafe extern "C" {
+        fn v8__V8__IsSandboxEnabled() -> bool;
+    }
+
+    // `rusty_v8` exposes this symbol for its own sandbox verification tests.
+    unsafe { v8__V8__IsSandboxEnabled() }
+}
+
 #[cfg(test)]
 mod tests {
     use pretty_assertions::assert_eq;
@@ -53,6 +64,11 @@ mod tests {
         assert!(!super::embedded_v8_version().is_empty());
     }
 
+    #[test]
+    fn sandbox_feature_matches_linked_v8() {
+        assert_eq!(super::linked_v8_has_sandbox(), cfg!(feature = "sandbox"));
+    }
+
     #[test]
     fn evaluates_integer_addition() {
         assert_eq!(evaluate_expression("1 + 2"), "3");