fix(bwrap): emit libcap after standalone archive

[viyatb-oai]

Why

#21255 added the standalone codex-bwrap binary. In the Cargo build, pkg_config::probe("libcap") emits -lcap before cc::Build::compile("standalone_bwrap") adds the static bwrap archive. The Linux musl link then sees -lcap -lstandalone_bwrap; because static archives are resolved left-to-right, cap_from_name is still undefined once standalone_bwrap introduces that reference.

The musl setup already builds libcap.a and exposes it through libcap.pc, so the failure is link ordering rather than a missing dependency.

What changed

• probe libcap with cargo_metadata(false) so pkg-config does not emit its link flags early
• emit the discovered libcap search paths and libraries after standalone_bwrap is compiled, preserving the needed static-link order

Verification

• cargo test -p codex-bwrap
• cargo clippy -p codex-bwrap --all-targets

The affected Linux musl release link is exercised by CI, which is the path this fix targets.