release: bundle bwrap with Linux codex DotSlash artifact

[bolinfest]

Why

#21255 changed the Linux sandbox fallback so Codex can use a bundled codex-resources/bwrap executable when no suitable system bwrap is available. That lookup is relative to the native Codex executable returned by
std::env::current_exe(), as implemented in bundled_bwrap.rs.

The release already publishes a separate bwrap DotSlash output, but the Linux codex DotSlash output still pointed at a single-binary .zst payload. Running the codex DotSlash manifest only materializes the native codex executable; it does not also create sibling files from the separate bwrap manifest. The fallback path therefore needs the Linux codex DotSlash artifact itself to include the real bwrap executable at codex-resources/bwrap.

What changed

• stage a Linux primary codex-<target>-bundle.tar.zst release artifact containing codex and codex-resources/bwrap
• point the Linux codex DotSlash outputs at that bundle tarball
• leave the standalone bwrap DotSlash output in place for consumers that want to fetch bwrap directly

Verification

• jq . .github/dotslash-config.json
• Ruby YAML parse of .github/workflows/rust-release.yml