[codex] Remove async_trait from first-party code (#27475)

## Why

First-party async traits should expose their `Send` contracts explicitly
without requiring `async_trait`. This completes the migration pattern
established in #27303 and #27304.

## What changed

- Replaced the remaining first-party `async_trait` traits with native
return-position `impl Future + Send` where statically dispatched and
explicit boxed `Send` futures where object safety is required.
- Kept implementations behavior-preserving, outlining existing async
bodies into inherent methods where that keeps the diff reviewable.
- Removed all direct first-party `async-trait` dependencies and the
workspace dependency declaration.
- Added a cargo-deny policy that permits `async-trait` only through the
remaining transitive wrapper crates.
- Updated `rand` from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097 and
keep the full cargo-deny check passing.

## Validation

- `just test -p codex-exec-server`: 216 passed, 2 skipped.
- `just test -p codex-model-provider`: 39 passed.
- `just test -p codex-core` and `just test`: changed tests passed;
remaining failures are environment-sensitive suites unrelated to this
migration.
- `cargo deny check`
- `just fix`
- `just fmt`
- `cargo shear`
- `just bazel-lock-check`

codex-rs/cloud-tasks-client/src/http.rs

@@ -2,6 +2,7 @@ use crate::ApplyOutcome;
 use crate::ApplyStatus;
 use crate::AttemptStatus;
 use crate::CloudBackend;
+use crate::CloudBackendFuture;
 use crate::CloudTaskError;
 use crate::DiffSummary;
 use crate::Result;
@@ -61,68 +62,77 @@ impl HttpClient {
     }
 }
 
-#[async_trait::async_trait]
 impl CloudBackend for HttpClient {
-    async fn list_tasks(
-        &self,
-        env: Option<&str>,
+    fn list_tasks<'a>(
+        &'a self,
+        env: Option<&'a str>,
         limit: Option<i64>,
-        cursor: Option<&str>,
-    ) -> Result<TaskListPage> {
-        self.tasks_api().list(env, limit, cursor).await
+        cursor: Option<&'a str>,
+    ) -> CloudBackendFuture<'a, TaskListPage> {
+        Box::pin(async move { self.tasks_api().list(env, limit, cursor).await })
     }
 
-    async fn get_task_summary(&self, id: TaskId) -> Result<TaskSummary> {
-        self.tasks_api().summary(id).await
+    fn get_task_summary(&self, id: TaskId) -> CloudBackendFuture<'_, TaskSummary> {
+        Box::pin(async move { self.tasks_api().summary(id).await })
     }
 
-    async fn get_task_diff(&self, id: TaskId) -> Result<Option<String>> {
-        self.tasks_api().diff(id).await
+    fn get_task_diff(&self, id: TaskId) -> CloudBackendFuture<'_, Option<String>> {
+        Box::pin(async move { self.tasks_api().diff(id).await })
     }
 
-    async fn get_task_messages(&self, id: TaskId) -> Result<Vec<String>> {
-        self.tasks_api().messages(id).await
+    fn get_task_messages(&self, id: TaskId) -> CloudBackendFuture<'_, Vec<String>> {
+        Box::pin(async move { self.tasks_api().messages(id).await })
     }
 
-    async fn get_task_text(&self, id: TaskId) -> Result<TaskText> {
-        self.tasks_api().task_text(id).await
+    fn get_task_text(&self, id: TaskId) -> CloudBackendFuture<'_, TaskText> {
+        Box::pin(async move { self.tasks_api().task_text(id).await })
     }
 
-    async fn list_sibling_attempts(
+    fn list_sibling_attempts(
         &self,
         task: TaskId,
         turn_id: String,
-    ) -> Result<Vec<TurnAttempt>> {
-        self.attempts_api().list(task, turn_id).await
+    ) -> CloudBackendFuture<'_, Vec<TurnAttempt>> {
+        Box::pin(async move { self.attempts_api().list(task, turn_id).await })
     }
 
-    async fn apply_task(&self, id: TaskId, diff_override: Option<String>) -> Result<ApplyOutcome> {
-        self.apply_api()
-            .run(id, diff_override, /*preflight*/ false)
-            .await
-    }
-
-    async fn apply_task_preflight(
+    fn apply_task(
         &self,
         id: TaskId,
         diff_override: Option<String>,
-    ) -> Result<ApplyOutcome> {
-        self.apply_api()
-            .run(id, diff_override, /*preflight*/ true)
-            .await
+    ) -> CloudBackendFuture<'_, ApplyOutcome> {
+        Box::pin(async move {
+            self.apply_api()
+                .run(id, diff_override, /*preflight*/ false)
+                .await
+        })
     }
 
-    async fn create_task(
+    fn apply_task_preflight(
         &self,
-        env_id: &str,
-        prompt: &str,
-        git_ref: &str,
+        id: TaskId,
+        diff_override: Option<String>,
+    ) -> CloudBackendFuture<'_, ApplyOutcome> {
+        Box::pin(async move {
+            self.apply_api()
+                .run(id, diff_override, /*preflight*/ true)
+                .await
+        })
+    }
+
+    fn create_task<'a>(
+        &'a self,
+        env_id: &'a str,
+        prompt: &'a str,
+        git_ref: &'a str,
         qa_mode: bool,
         best_of_n: usize,
-    ) -> Result<crate::CreatedTask> {
-        self.tasks_api()
-            .create(env_id, prompt, git_ref, qa_mode, best_of_n)
-            .await
+    ) -> CloudBackendFuture<'a, crate::CreatedTask> {
+        Box::pin(async move {
+            self.tasks_api()
+                .create(env_id, prompt, git_ref, qa_mode, best_of_n)
+                .await
+        })
     }
 }