Verify bundled bwrap in Bazel builds (#38494)

## Why

Bazel builds did not embed the SHA-256 digest used to verify the bundled
`bwrap` binary at launch.

## What changed

- Strip the Bazel-built `bwrap`, generate its SHA-256 digest, and pass that
  digest to `codex-linux-sandbox` through a compiler environment file.
- Report digest verification failures with exit code `8` instead of panicking.
- Add a Bazel integration test that accepts the original bundled binary and
  rejects a tampered copy.

GitOrigin-RevId: 224eeb6ae3d1bfb100e048b296f75fd8ba109581

codex-rs/bwrap/BUILD.bazel

@@ -12,11 +12,29 @@ codex_rust_crate(
         "//conditions:default": [],
     }),
     rustc_flags_extra = select({
-        "@platforms//os:linux": ["--cfg=bwrap_available"],
+        "@platforms//os:linux": [
+            "--cfg=bwrap_available",
+            # TODO(anp) Extract bwrap symbols before stripping.
+            "-Cstrip=symbols",
+        ],
         "//conditions:default": [],
     }),
 )
 
+genrule(
+    name = "bwrap-sha256-env",
+    srcs = [":bwrap"],
+    outs = ["bwrap.sha256.env"],
+    cmd = " && ".join([
+        '$(execpath @bazel_tools//tools/build_defs/hash:sha256) $(execpath :bwrap) "$@"',
+        'digest=$$(<"$@")',
+        'printf "CODEX_BWRAP_SHA256=%s\\n" "$$digest" > "$@"',
+    ]),
+    target_compatible_with = ["@platforms//os:linux"],
+    tools = ["@bazel_tools//tools/build_defs/hash:sha256"],
+    visibility = ["//codex-rs/linux-sandbox:__pkg__"],
+)
+
 cc_library(
     name = "bwrap-ffi",
     srcs = ["//codex-rs/vendor:bubblewrap_c_sources"],