build(linux-sandbox): always compile vendored bubblewrap on Linux; remove CODEX_BWRAP_ENABLE_FFI (#11498)

## Summary
This PR removes the temporary `CODEX_BWRAP_ENABLE_FFI` flag and makes
Linux builds always compile vendored bubblewrap support for
`codex-linux-sandbox`.

## Changes
- Removed `CODEX_BWRAP_ENABLE_FFI` gating from
`codex-rs/linux-sandbox/build.rs`.
- Linux builds now fail fast if vendored bubblewrap compilation fails
(instead of warning and continuing).
- Updated fallback/help text in
`codex-rs/linux-sandbox/src/vendored_bwrap.rs` to remove references to
`CODEX_BWRAP_ENABLE_FFI`.
- Removed `CODEX_BWRAP_ENABLE_FFI` env wiring from:
  - `.github/workflows/rust-ci.yml`
  - `.github/workflows/bazel.yml`
  - `.github/workflows/rust-release.yml`

---------

Co-authored-by: David Zbarsky <zbarsky@openai.com>

codex-rs/linux-sandbox/BUILD.bazel

@@ -1,6 +1,36 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
 load("//:defs.bzl", "codex_rust_crate")
 
 codex_rust_crate(
     name = "linux-sandbox",
     crate_name = "codex_linux_sandbox",
+    # Bazel wires vendored bubblewrap + libcap via :vendored-bwrap-ffi below
+    # and sets vendored_bwrap_available explicitly, so we skip Cargo's
+    # build.rs in Bazel builds.
+    build_script_enabled = False,
+    deps_extra = select({
+        "@platforms//os:linux": [":vendored-bwrap-ffi"],
+        "//conditions:default": [],
+    }),
+    rustc_flags_extra = select({
+        "@platforms//os:linux": ["--cfg=vendored_bwrap_available"],
+        "//conditions:default": [],
+    }),
+)
+
+cc_library(
+    name = "vendored-bwrap-ffi",
+    srcs = ["//codex-rs/vendor:bubblewrap_c_sources"],
+    hdrs = [
+        "config.h",
+        "//codex-rs/vendor:bubblewrap_headers",
+    ],
+    copts = [
+        "-D_GNU_SOURCE",
+        "-Dmain=bwrap_main",
+    ],
+    includes = ["."],
+    deps = ["@libcap//:libcap"],
+    target_compatible_with = ["@platforms//os:linux"],
+    visibility = ["//visibility:private"],
 )