Uprev Rust toolchain pins to 1.95.0 (#24684)

## Summary
- Bump the workspace Rust toolchain from `1.93.0` to `1.95.0` across
Cargo, Bazel, CI, release workflows, devcontainers, and the Codex
environment config.
- Refresh `MODULE.bazel.lock` so the Bazel Rust toolchain artifacts
match the new version.
- Leave purpose-specific toolchains unchanged, including the
`argument-comment-lint` nightly and the upstream `rusty_v8` `1.91.0`
build pin.
- Includes fixes for new lints from `just fix` and a few codex-authored
fixes for lints without a suggestion.

codex-rs/app-server-transport/src/transport/remote_control/websocket.rs

@@ -1390,14 +1390,13 @@ pub(super) async fn connect_remote_control_websocket(
                     status_publisher.publish_environment_id(/*environment_id*/ None);
                 }
                 tungstenite::Error::Http(response)
-                    if matches!(response.status().as_u16(), 401 | 403) =>
+                    if matches!(response.status().as_u16(), 401 | 403)
+                        && recover_remote_control_auth(auth_recovery, auth_change_rx).await =>
                 {
-                    if recover_remote_control_auth(auth_recovery, auth_change_rx).await {
-                        return Err(io::Error::other(format!(
-                            "remote control websocket auth failed with HTTP {}; retrying after auth recovery",
-                            response.status()
-                        )));
-                    }
+                    return Err(io::Error::other(format!(
+                        "remote control websocket auth failed with HTTP {}; retrying after auth recovery",
+                        response.status()
+                    )));
                 }
                 _ => {}
             }

codex-rs/app-server-transport/src/transport/websocket.rs

@@ -347,7 +347,7 @@ async fn run_websocket_inbound_loop<M, StreamError>(
             incoming_message = websocket_reader.next() => {
                 match incoming_message {
                     Some(Ok(message)) => match message.into_incoming() {
-                        Some(IncomingWebSocketMessage::Text(text)) => {
+                        Some(IncomingWebSocketMessage::Text(text))
                             if !forward_incoming_message(
                                 &transport_event_tx,
                                 &writer_tx_for_reader,
@@ -355,10 +355,10 @@ async fn run_websocket_inbound_loop<M, StreamError>(
                                 &text,
                             )
                             .await
-                            {
-                                break;
-                            }
+                        => {
+                            break;
                         }
+                        Some(IncomingWebSocketMessage::Text(_)) => {}
                         Some(IncomingWebSocketMessage::Ping(payload)) => {
                             match writer_control_tx.try_send(M::pong(payload)) {
                                 Ok(()) => {}