[codex] bundle code mode host in release packages

[cconger]

Summary

• build, strip, sign, and publish codex-code-mode-host with the primary Codex release binaries on Linux, macOS, and Windows
• place the host beside codex[.exe] in canonical package archives, macOS DMGs, and the legacy Linux bundle so the runtime's sibling lookup succeeds
• preserve and validate the host through standalone installers and Python runtime wheel staging
• add package-builder coverage for source selection and the resulting package layout

Why

The process-owned code-mode client launches codex-code-mode-host as a sibling of the running Codex executable. Release artifacts currently build and bundle codex without that host, so code mode cannot start from installed packages.

Validation

• python3 -m unittest discover -s scripts/codex_package -p 'test_*.py'
• python3 -m pytest sdk/python/tests/test_artifact_workflow_and_binaries.py -q -k 'runtime_package or stage_runtime_release'
• end-to-end package assembly with prebuilt fixture binaries for x86_64-pc-windows-msvc
• bash -n .github/scripts/build-codex-package-archive.sh scripts/install/install.sh
• UV_CACHE_DIR=/tmp/codex-uv-cache just fmt
• git diff --check

The full Python artifact test file was also attempted; two schema-generation tests require the pinned openai-codex-cli-bin==0.137.0a4 package, which is not installed in this environment. The runtime-staging subset affected by this change passes. actionlint was not available locally.