refactor: rewrite argument-comment lint wrappers in Python (#16063)

## Why

The `argument-comment-lint` entrypoints had grown into two shell
wrappers with duplicated parsing, environment setup, and Cargo
forwarding logic. The recent `--` separator regression was a good
example of the problem: the behavior was subtle, easy to break, and hard
to verify.

This change rewrites those wrappers in Python so the control flow is
easier to follow, the shared behavior lives in one place, and the tricky
argument/defaulting paths have direct test coverage.

## What changed

- replaced `tools/argument-comment-lint/run.sh` and
`tools/argument-comment-lint/run-prebuilt-linter.sh` with Python
entrypoints: `run.py` and `run-prebuilt-linter.py`
- moved shared wrapper behavior into
`tools/argument-comment-lint/wrapper_common.py`, including:
  - splitting lint args from forwarded Cargo args after `--`
- defaulting repo runs to `--manifest-path codex-rs/Cargo.toml
--workspace --no-deps`
- defaulting non-`--fix` runs to `--all-targets` unless the caller
explicitly narrows the target set
  - setting repo defaults for `DYLINT_RUSTFLAGS` and `CARGO_INCREMENTAL`
- kept the prebuilt wrapper thin: it still just resolves the packaged
DotSlash entrypoint, keeps `rustup` shims first on `PATH`, infers
`RUSTUP_HOME` when needed, and then launches the packaged `cargo-dylint`
path
- updated `justfile`, `rust-ci.yml`, and
`tools/argument-comment-lint/README.md` to use the Python entrypoints
- updated `rust-ci` so the package job runs Python syntax checks plus
the new wrapper unit tests, and the OS-specific lint jobs invoke the
wrappers through an explicit Python interpreter

This is a follow-up to #16054: it keeps the current lint semantics while
making the wrapper logic maintainable enough to iterate on safely.

## Validation

- `python3 -m py_compile tools/argument-comment-lint/wrapper_common.py
tools/argument-comment-lint/run.py
tools/argument-comment-lint/run-prebuilt-linter.py
tools/argument-comment-lint/test_wrapper_common.py`
- `python3 -m unittest discover -s tools/argument-comment-lint -p
'test_*.py'`
- `python3 ./tools/argument-comment-lint/run-prebuilt-linter.py -p
codex-terminal-detection -- --lib`
- `python3 ./tools/argument-comment-lint/run.py -p
codex-terminal-detection -- --lib`

tools/argument-comment-lint/README.md

@@ -84,9 +84,9 @@ rustup toolchain install nightly-2025-09-18 \
 ```
 
 The checked-in DotSlash file lives at `tools/argument-comment-lint/argument-comment-lint`.
-`run-prebuilt-linter.sh` resolves that file via `dotslash` and is the path used by
+`run-prebuilt-linter.py` resolves that file via `dotslash` and is the path used by
 `just clippy`, `just argument-comment-lint`, and the Rust CI job. The
-source-build path remains available in `run.sh` for people
+source-build path remains available in `run.py` for people
 iterating on the lint crate itself.
 
 The Unix archive layout is:
@@ -110,7 +110,7 @@ host-qualified nightly filename to the plain `nightly-2025-09-18` channel when
 needed, and then invokes `cargo-dylint dylint --lib-path <that-library>` with
 the repo's default `DYLINT_RUSTFLAGS` and `CARGO_INCREMENTAL=0` settings.
 
-The checked-in `run-prebuilt-linter.sh` wrapper uses the fetched package
+The checked-in `run-prebuilt-linter.py` wrapper uses the fetched package
 contents directly so the current checked-in alpha artifact works the same way.
 It also makes sure the `rustup` shims stay ahead of any direct toolchain
 `cargo` binary on `PATH`, and sets `RUSTUP_HOME` from `rustup show home` when
@@ -120,17 +120,17 @@ required for the current Windows Dylint driver path.
 If you are changing the lint crate itself, use the source-build wrapper:
 
 ```bash
-./tools/argument-comment-lint/run.sh -p codex-core
+./tools/argument-comment-lint/run.py -p codex-core
 ```
 
 Run the lint against `codex-rs` from the repo root:
 
 ```bash
-./tools/argument-comment-lint/run-prebuilt-linter.sh -p codex-core
+./tools/argument-comment-lint/run-prebuilt-linter.py -p codex-core
 just argument-comment-lint -p codex-core
 ```
 
-If no package selection is provided, `run-prebuilt-linter.sh` defaults to checking the
+If no package selection is provided, `run-prebuilt-linter.py` defaults to checking the
 `codex-rs` workspace with `--workspace --no-deps`.
 For non-`--fix` runs, both wrappers also default the underlying Cargo
 invocation to `--all-targets` unless you explicitly narrow the target set, so
@@ -140,7 +140,7 @@ Repo runs also promote `uncommented_anonymous_literal_argument` to an error by
 default:
 
 ```bash
-./tools/argument-comment-lint/run-prebuilt-linter.sh -p codex-core
+./tools/argument-comment-lint/run-prebuilt-linter.py -p codex-core
 ```
 
 The wrapper does that by setting `DYLINT_RUSTFLAGS`, and it leaves an explicit
@@ -152,11 +152,11 @@ hoc run:
 ```bash
 DYLINT_RUSTFLAGS="-A uncommented-anonymous-literal-argument" \
 CARGO_INCREMENTAL=1 \
-  ./tools/argument-comment-lint/run.sh -p codex-core
+  ./tools/argument-comment-lint/run.py -p codex-core
 ```
 
 To override an explicitly narrow target selection, or to be explicit in scripts:
 
 ```bash
-./tools/argument-comment-lint/run-prebuilt-linter.sh -p codex-core -- --all-targets
+./tools/argument-comment-lint/run-prebuilt-linter.py -p codex-core -- --all-targets
 ```