fix: close Bazel argument-comment-lint CI gaps (#16253)

## Why

The Bazel-backed `argument-comment-lint` CI path had two gaps:

- Bazel wildcard target expansion skipped inline unit-test crates from
`src/` modules because the generated `*-unit-tests-bin` `rust_test`
targets are tagged `manual`.
- `argument-comment-mismatch` was still only a warning in the Bazel and
packaged-wrapper entrypoints, so a typoed `/*param_name*/` comment could
still pass CI even when the lint detected it.

That left CI blind to real linux-sandbox examples, including the missing
`/*local_port*/` comment in
`codex-rs/linux-sandbox/src/proxy_routing.rs` and typoed argument
comments in `codex-rs/linux-sandbox/src/landlock.rs`.

## What Changed

- Added `tools/argument-comment-lint/list-bazel-targets.sh` so Bazel
lint runs cover `//codex-rs/...` plus the manual `rust_test`
`*-unit-tests-bin` targets.
- Updated `just argument-comment-lint`, `rust-ci.yml`, and
`rust-ci-full.yml` to use that helper.
- Promoted both `argument-comment-mismatch` and
`uncommented-anonymous-literal-argument` to errors in every strict
entrypoint:
  - `tools/argument-comment-lint/lint_aspect.bzl`
  - `tools/argument-comment-lint/src/bin/argument-comment-lint.rs`
  - `tools/argument-comment-lint/wrapper_common.py`
- Added wrapper/bin coverage for the stricter lint flags and documented
the behavior in `tools/argument-comment-lint/README.md`.
- Fixed the now-covered callsites in
`codex-rs/linux-sandbox/src/proxy_routing.rs`,
`codex-rs/linux-sandbox/src/landlock.rs`, and
`codex-rs/core/src/shell_snapshot_tests.rs`.

This keeps the Bazel target expansion narrow while making the Bazel and
prebuilt-linter paths enforce the same strict lint set.

## Verification

- `python3 -m unittest discover -s tools/argument-comment-lint -p
'test_*.py'`
- `cargo +nightly-2025-09-18 test --manifest-path
tools/argument-comment-lint/Cargo.toml`
- `just argument-comment-lint`

tools/argument-comment-lint/src/bin/argument-comment-lint.rs

@@ -8,6 +8,11 @@ use std::process::ExitCode;
 use std::time::SystemTime;
 use std::time::UNIX_EPOCH;
 
+const STRICT_LINTS: [&str; 2] = [
+    "argument-comment-mismatch",
+    "uncommented-anonymous-literal-argument",
+];
+
 fn main() -> ExitCode {
     match run() {
         Ok(code) => code,
@@ -85,14 +90,13 @@ fn has_library_selection(args: &[OsString]) -> bool {
 fn set_default_env(command: &mut Command) -> Result<(), String> {
     if let Some(flags) = env::var_os("DYLINT_RUSTFLAGS") {
         let mut flags = flags.to_string_lossy().to_string();
-        append_flag_if_missing(&mut flags, "-D uncommented-anonymous-literal-argument");
+        for strict_lint in STRICT_LINTS {
+            append_flag_if_missing(&mut flags, &format!("-D {strict_lint}"));
+        }
         append_flag_if_missing(&mut flags, "-A unknown_lints");
         command.env("DYLINT_RUSTFLAGS", flags);
     } else {
-        command.env(
-            "DYLINT_RUSTFLAGS",
-            "-D uncommented-anonymous-literal-argument -A unknown_lints",
-        );
+        command.env("DYLINT_RUSTFLAGS", strict_rustflags());
     }
 
     if env::var_os("CARGO_INCREMENTAL").is_none() {
@@ -108,6 +112,15 @@ fn set_default_env(command: &mut Command) -> Result<(), String> {
     Ok(())
 }
 
+fn strict_rustflags() -> String {
+    let strict_flags = STRICT_LINTS
+        .iter()
+        .map(|lint| format!("-D {lint}"))
+        .collect::<Vec<_>>()
+        .join(" ");
+    format!("{strict_flags} -A unknown_lints")
+}
+
 fn append_flag_if_missing(flags: &mut String, flag: &str) {
     if flags.contains(flag) {
         return;
@@ -253,6 +266,7 @@ fn exit_code_from_status(code: Option<i32>) -> ExitCode {
 #[cfg(test)]
 mod tests {
     use super::normalize_nightly_library_filename;
+    use super::strict_rustflags;
     use std::path::Path;
 
     #[test]
@@ -276,4 +290,12 @@ mod tests {
             None
         );
     }
+
+    #[test]
+    fn strict_rustflags_promotes_both_enforced_lints() {
+        assert_eq!(
+            strict_rustflags(),
+            "-D argument-comment-mismatch -D uncommented-anonymous-literal-argument -A unknown_lints"
+        );
+    }
 }