refactor: delete exec-server and move execve wrapper into shell-escalation

[bolinfest]

Why

We already plan to remove the shell-tool MCP path, and doing that cleanup first makes the follow-on shell-escalation work much simpler.

This change removes the last remaining reason to keep codex-rs/exec-server around by moving the codex-execve-wrapper binary and shared shell test fixtures to the crates/tests that now own that functionality.

What Changed

Delete codex-rs/exec-server

• Remove the exec-server crate, including the MCP server binary, MCP-specific modules, and its test support/test suite
• Remove exec-server from the codex-rs workspace and update Cargo.lock

Move codex-execve-wrapper into codex-rs/shell-escalation

• Move the wrapper implementation into shell-escalation (src/unix/execve_wrapper.rs)
• Add the codex-execve-wrapper binary entrypoint under shell-escalation/src/bin/
• Update shell-escalation exports/module layout so the wrapper entrypoint is hosted there
• Move the wrapper README content from exec-server to shell-escalation/README.md

Move shared shell test fixtures to app-server

• Move the DotSlash bash/zsh test fixtures from exec-server/tests/suite/ to app-server/tests/suite/
• Update app-server zsh-fork tests to reference the new fixture paths

Keep shell-tool-mcp as a shell-assets package

• Update .github/workflows/shell-tool-mcp.yml packaging so the npm artifact contains only patched Bash/Zsh payloads (no Rust binaries)
• Update shell-tool-mcp/package.json, shell-tool-mcp/src/index.ts, and docs to reflect the shell-assets-only package shape
• shell-tool-mcp-ci.yml does not need changes because it is already JS-only

Verification

• cargo shear
• cargo clippy -p codex-shell-escalation --tests
• just clippy

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a14abcb915

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Restore Rust binaries as package prerequisites

The package job no longer depends on any Rust binary build, so its staged vendor/ payload is assembled only from Bash/Zsh artifacts. The published launcher still requires vendor/<target>/codex-exec-mcp-server and codex-execve-wrapper at startup (shell-tool-mcp/src/index.ts throws Required binary missing when they are absent), so this workflow now produces npm tarballs that install but fail immediately at runtime on all platforms.

Useful? React with 👍 / 👎.