Support close-on-exec attachments without changing PTY semantics (#47797)

## Why

Passing extra descriptors to a PTY previously selected behavior intended for inherited escalation sockets: no EOF on stdin close, different signal exit statuses, and no default `SHELL`. Launch attachments need ordinary PTY behavior and must survive execution even when marked `FD_CLOEXEC`.

## What changed

- Add `ChildFds::Attached` alongside `ChildFds::Inherited` to distinguish launch attachments from legacy inherited descriptors.
- Preserve ordinary EOF, default `SHELL`, and signal exit status behavior for PTY attachments.
- Allow explicitly supplied close-on-exec descriptors through pipe and PTY launches without changing the parent's descriptor flags, using child-side flag updates and macOS spawn inheritance actions.
- Update existing callers to use `ChildFds::Inherited`.

## Testing

Add Unix coverage for attachment accessibility, unchanged parent descriptor flags, default `SHELL`, and signal exit statuses. Extend the PTY stdin-draining test to cover attachments and EOF delivery.

GitOrigin-RevId: 864aedc6c5717d8b43c9d71057c9f54409834509

bazel/rules/testing/wine/src/lib_tests.rs

@@ -367,7 +367,7 @@ async fn pinned_powershell_runs_under_wine_with_a_pty() -> Result<()> {
         &env,
         /*arg0*/ &None,
         TerminalSize::default(),
-        /*inherited_fds*/ &[],
+        codex_utils_pty::ChildFds::Inherited(&[]),
     )
     .await?;
     let command_result = timeout(Duration::from_secs(30), async {