[codex] Fix current main CI blockers

[sayan-oai]

Summary

• Fix marketplace-add local path detection on Windows by using Path::is_absolute().
• Make marketplace-add local-source tests parse/write TOML through the same helpers instead of raw string matching.
• Update rand 0.9.x to 0.9.3 and document the remaining audited rand 0.8.5 advisory exception.
• Refresh MODULE.bazel.lock after the Cargo.lock update.

Why

Latest main had two independent CI blockers: marketplace-add tests were not portable to Windows path/TOML escaping, and cargo-deny still reported RUSTSEC-2026-0097 after the recent rustls-webpki fix.

Validation

• cargo test -p codex-core marketplace_add -- --nocapture
• cargo deny --all-features check
• just bazel-lock-check
• just fix -p codex-core
• just fmt
• git diff --check