Verify bundled bwrap in Bazel builds (#38494)

## Why

Bazel builds did not embed the SHA-256 digest used to verify the bundled
`bwrap` binary at launch.

## What changed

- Strip the Bazel-built `bwrap`, generate its SHA-256 digest, and pass that
  digest to `codex-linux-sandbox` through a compiler environment file.
- Report digest verification failures with exit code `8` instead of panicking.
- Add a Bazel integration test that accepts the original bundled binary and
  rejects a tampered copy.

GitOrigin-RevId: 224eeb6ae3d1bfb100e048b296f75fd8ba109581

codex-rs/linux-sandbox/BUILD.bazel

@@ -6,4 +6,8 @@ codex_rust_crate(
     extra_binaries = [
         "//codex-rs/bwrap:bwrap",
     ],
+    rustc_env_files = select({
+        "@platforms//os:linux": ["//codex-rs/bwrap:bwrap-sha256-env"],
+        "//conditions:default": [],
+    }),
 )