Fix voice runtime release builds and packaging (#44062)

## What changed

- Build the voice host and native runtime with Bazel's `-c opt` configuration.
- Resolve runtime paths before validating their contents in the release workflow.
- Make `runtime.json` owner-writable before sealing the post-signing release receipt.
- Use `scripts` in `PYTHONPATH` so archive creation can import `codex_package.archive`.

GitOrigin-RevId: 02f960573a4151f52cde486e17e1d45b73435306

third_party/voice/release_runtime.py

@@ -37,6 +37,7 @@ def seal(root: Path, target: str) -> None:
         record["sha256"] = digest(root / record["path"])
     manifest["developmentOnly"] = False
     manifest["distribution"] = "publicRelease"
+    manifest_path.chmod(manifest_path.stat().st_mode | 0o200)
     manifest_path.write_text(json.dumps(manifest, indent=2) + "\n", encoding="utf-8")
     runtime_files(root, target, public_release=True)