fix(ci): restore guardian coverage and bazel unit tests

[charley-oai]

Summary

• restore the guardian review request snapshot test and its tracked snapshot after it was dropped from main
• make Bazel Rust unit-test wrappers resolve runfiles correctly on manifest-only platforms like macOS and point Insta at the real workspace root
• harden the shell-escalation socket-closure assertion so the musl Bazel test no longer depends on fd reuse behavior

Verification

• cargo test -p codex-core guardian_review_request_layout_matches_model_visible_request_snapshot
• cargo test -p codex-shell-escalation
• bazel test //codex-rs/exec:exec-unit-tests //codex-rs/shell-escalation:shell-escalation-unit-tests

Supersedes #13894.

Codex author

codex resume 019cc9d6-bd74-7971-acc1-24ce42e715d7

[charley-oai]

@codex review this

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9a2633df5e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[charley-oai]

@codex review this

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".