ci: verify codex-rs Cargo manifests inherit workspace settings

[bolinfest]

Why

Bazel clippy now catches lints that cargo clippy can still miss when a crate under codex-rs forgets to opt into workspace lints. The concrete example here was codex-rs/app-server/tests/common/Cargo.toml: Bazel flagged a clippy violation in models_cache.rs, but Cargo did not because that crate inherited workspace package metadata without declaring [lints] workspace = true.

We already mirror the workspace clippy deny list into Bazel after #15955, so we also need a repo-side check that keeps every codex-rs manifest opted into the same workspace settings.

What changed

• add .github/scripts/verify_cargo_workspace_manifests.py, which parses every codex-rs/**/Cargo.toml with tomllib and verifies:
  • version.workspace = true
  • edition.workspace = true
  • license.workspace = true
  • [lints] workspace = true
  • top-level crate names follow the codex-* / codex-utils-* conventions, with explicit exceptions for windows-sandbox-rs and utils/path-utils
• run that script in .github/workflows/ci.yml
• update the current outlier manifests so the check is enforceable immediately
• fix the newly exposed clippy violations in the affected crates (app-server/tests/common, file-search, feedback, shell-escalation, and debug-client)

---

Stack created with Sapling. Best reviewed with ReviewStack.

• ci: sync Bazel clippy lints and fix uncovered violations #16351
• -> ci: verify codex-rs Cargo manifests inherit workspace settings #16353