Enable --deny-warnings for cargo shear (#21616)

## Summary

In https://github.com/openai/codex/pull/21584, we disabled doctests for
crates that lack any doctests. We can enforce that property via `cargo
shear --deny-warnings`: crates that lack doctests will be flagged if
doctests are enabled, and crates with doctests will be flagged if
doctests are disabled.

A few additional notes:

- By adding `--deny-warnings`, `cargo shear` also flagged a number of
modules that were not reachable at all. Some of those have been removed.
- This PR removes a usage of `windows_modules!` (since `cargo shear` and
`rustfmt` couldn't see through it) in favor of simple `#[cfg(target_os =
"windows")]` macros. As a consequence, many of these files exhibit churn
in this PR, since they weren't being formatted by `rustfmt` at all on
main.
- Again, to make the code more analyzable, this PR also removes some
usages of `#[path = "cwd_junction.rs"]` in favor of a more standard
module structure. The bin sidecar structure is still retained, but,
e.g., `windows-sandbox-rs/src/bin/command_runner.rs‎` was moved to
`windows-sandbox-rs/src/bin/command_runner/main.rs`, and so on.

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/windows-sandbox-rs/src/cap.rs

@@ -1,15 +1,15 @@
+use crate::path_normalization::canonical_path_key;
 use anyhow::Context;
 use anyhow::Result;
-use rand::rngs::SmallRng;
 use rand::RngCore;
 use rand::SeedableRng;
+use rand::rngs::SmallRng;
 use serde::Deserialize;
 use serde::Serialize;
 use std::collections::HashMap;
 use std::fs;
 use std::path::Path;
 use std::path::PathBuf;
-use crate::path_normalization::canonical_path_key;
 
 #[derive(Serialize, Deserialize, Clone, Debug)]
 pub struct CapSids {
@@ -106,7 +106,12 @@ mod tests {
         std::fs::create_dir_all(&workspace).expect("create workspace root");
 
         let canonical = dunce::canonicalize(&workspace).expect("canonical workspace root");
-        let alt_spelling = PathBuf::from(canonical.to_string_lossy().replace('\\', "/").to_ascii_uppercase());
+        let alt_spelling = PathBuf::from(
+            canonical
+                .to_string_lossy()
+                .replace('\\', "/")
+                .to_ascii_uppercase(),
+        );
 
         let first_sid =
             workspace_cap_sid_for_cwd(&codex_home, canonical.as_path()).expect("first sid");