Enable V8 sandboxing for source-built builds (#21146)

## Summary

This is the first PR in the V8 in-process sandboxing rollout.

It adds the build-system and Rust feature plumbing needed to support
sandboxed V8 builds, then enables sandboxing by default for the
source-built Bazel V8 path that we control directly. It deliberately
keeps the published `rusty_v8` artifact workflows on their current
non-sandboxed contract so this PR can land and ship independently before
we change any released artifacts.

## Rollout plan

- [x] **PR 1: land sandbox plumbing and default source-built Bazel V8 to
sandboxed mode**

- [ ] **PR 2: publish sandbox-enabled release artifacts and add
compatibility validation**
- Produce sandboxed artifact pairs for every released Cargo target that
does not already use the source-built Bazel path.
- Add CI coverage that consumes those sandboxed artifacts and verifies:
    - `codex-v8-poc` reports sandbox enabled
    - `codex-code-mode` builds/tests against the sandboxed path

- [ ] **PR 3: switch release consumers to sandboxed artifacts by
default**
  - Update released artifact selectors/checksums.
- Enable the Rust `v8_enable_sandbox` feature in the default release
path.
- Make the sandboxed artifact family the normal path for published
builds.

- [ ] **PR 4: remove rollout-only compatibility paths**
- Remove the temporary non-sandbox release compatibility config once the
new default has shipped and baked.
  - Keep the invariant tests permanently.

patches/v8_bazel_rules.patch

@@ -65,10 +65,19 @@ index 9648e4a..88efd41 100644
              ":should_add_rdynamic": ["-rdynamic"],
              "//conditions:default": [],
 diff --git a/orig/v8-14.6.202.11/BUILD.bazel b/mod/v8-14.6.202.11/BUILD.bazel
-index 85f31b7..7314584 100644
+index 85f31b7..bbc351b 100644
 --- a/orig/v8-14.6.202.11/BUILD.bazel
 +++ b/mod/v8-14.6.202.11/BUILD.bazel
-@@ -303,7 +303,7 @@ v8_int(
+@@ -148,6 +148,8 @@ v8_flag(name = "v8_enable_trace_maps")
+ 
+ v8_flag(name = "v8_enable_v8_checks")
+ 
++v8_flag(name = "v8_enable_sandbox")
++
+ v8_flag(name = "v8_enable_verify_csa")
+ 
+ v8_flag(name = "v8_enable_verify_heap")
+@@ -303,7 +305,7 @@ v8_int(
  # If no explicit value for v8_enable_pointer_compression, we set it to 'none'.
  v8_string(
      name = "v8_enable_pointer_compression",
@@ -77,7 +86,15 @@ index 85f31b7..7314584 100644
  )
  
  # Default setting for v8_enable_pointer_compression.
-@@ -4077,28 +4077,14 @@ filegroup(
+@@ -503,6 +505,7 @@ v8_config(
+         "v8_enable_slow_dchecks": "ENABLE_SLOW_DCHECKS",
+         "v8_enable_runtime_call_stats": "V8_RUNTIME_CALL_STATS",
+         "v8_enable_snapshot_native_code_counters": "V8_SNAPSHOT_NATIVE_CODE_COUNTERS",
++        "v8_enable_sandbox": "V8_ENABLE_SANDBOX",
+         "v8_enable_trace_maps": "V8_TRACE_MAPS",
+         "v8_enable_turbofan": "V8_ENABLE_TURBOFAN",
+         "v8_enable_v8_checks": "V8_ENABLE_CHECKS",
+@@ -4077,28 +4080,14 @@ filegroup(
      }),
  )
  
@@ -112,7 +129,7 @@ index 85f31b7..7314584 100644
  )
  
  filegroup(
-@@ -4405,6 +4391,20 @@ genrule(
+@@ -4405,6 +4394,20 @@ genrule(
      srcs = [
          "include/js_protocol.pdl",
          "src/inspector/inspector_protocol_config.json",
@@ -133,7 +150,7 @@ index 85f31b7..7314584 100644
      ],
      outs = [
          "include/inspector/Debugger.h",
-@@ -4426,15 +4426,19 @@ genrule(
+@@ -4426,15 +4429,19 @@ genrule(
          "src/inspector/protocol/Schema.cpp",
          "src/inspector/protocol/Schema.h",
      ],
@@ -157,7 +174,7 @@ index 85f31b7..7314584 100644
      ],
  )
  
-@@ -4448,6 +4451,15 @@ filegroup(
+@@ -4448,6 +4455,15 @@ filegroup(
      ],
  )
  
@@ -173,7 +190,7 @@ index 85f31b7..7314584 100644
  filegroup(
      name = "d8_files",
      srcs = [
-@@ -4567,16 +4579,9 @@ cc_library(
+@@ -4567,16 +4583,9 @@ cc_library(
      ],
  )
  
@@ -192,7 +209,8 @@ index 85f31b7..7314584 100644
 +    actual = "@simdutf//:simdutf",
  )
  
-@@ -4593,7 +4598,7 @@ v8_library(
+ v8_library(
+@@ -4593,7 +4602,7 @@ v8_library(
      copts = ["-Wno-implicit-fallthrough"],
      icu_deps = [
          ":icu/generated_torque_definitions_headers",
@@ -201,7 +219,7 @@ index 85f31b7..7314584 100644
      ],
      icu_srcs = [
          ":generated_regexp_special_case",
-@@ -4608,7 +4613,7 @@ v8_library(
+@@ -4608,7 +4617,7 @@ v8_library(
      ],
      deps = [
          ":lib_dragonbox",
@@ -210,7 +228,7 @@ index 85f31b7..7314584 100644
          ":lib_fp16",
          ":simdutf",
          ":v8_libbase",
-@@ -4664,6 +4669,7 @@ alias(
+@@ -4664,6 +4673,7 @@ alias(
  alias(
      name = "core_lib_icu",
      actual = "icu/v8",
@@ -218,7 +236,7 @@ index 85f31b7..7314584 100644
  )
  
  v8_library(
-@@ -4715,7 +4721,7 @@ v8_binary(
+@@ -4715,7 +4725,7 @@ v8_binary(
      ],
      deps = [
          ":v8_libbase",