fix: keep zsh-fork release assets after removing shell-tool-mcp (#15644)

## Why

`shell-tool-mcp` and the Bash fork are no longer needed, but the patched
zsh fork is still relevant for shell escalation and for the
DotSlash-backed zsh-fork integration tests.

Deleting the old `shell-tool-mcp` workflow also deleted the only
pipeline that rebuilt those patched zsh binaries. This keeps the package
removal, while preserving a small release path that can be reused
whenever `codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch`
changes.

## What changed

- removed the `shell-tool-mcp` workspace package, its npm
packaging/release jobs, the Bash test fixture, and the remaining
Bash-specific compatibility wiring
- deleted the old `.github/workflows/shell-tool-mcp.yml` and
`.github/workflows/shell-tool-mcp-ci.yml` workflows now that their
responsibilities have been replaced or removed
- kept the zsh patch under
`codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch` and updated
the `codex-rs/shell-escalation` docs/code to describe the zsh-based flow
directly
- added `.github/workflows/rust-release-zsh.yml` to build only the three
zsh binaries that `codex-rs/app-server/tests/suite/zsh` needs today:
  - `aarch64-apple-darwin` on `macos-15`
  - `x86_64-unknown-linux-musl` on `ubuntu-24.04`
  - `aarch64-unknown-linux-musl` on `ubuntu-24.04`
- extracted the shared zsh build/smoke-test/stage logic into
`.github/scripts/build-zsh-release-artifact.sh`, made that helper
directly executable, and now invoke it directly from the workflow so the
Linux and macOS jobs only keep the OS-specific setup in YAML
- wired those standalone `codex-zsh-*.tar.gz` assets into
`rust-release.yml` and added `.github/dotslash-zsh-config.json` so
releases also publish a `codex-zsh` DotSlash file
- updated the checked-in `codex-rs/app-server/tests/suite/zsh` fixture
comments to explain that new releases come from the standalone zsh
assets, while the checked-in fixture remains pinned to the latest
historical release until a newer zsh artifact is published
- tightened a couple of follow-on cleanups in
`codex-rs/shell-escalation`: the `ExecParams::command` comment now
describes the shell `-c`/`-lc` string more clearly, and the README now
points at the same `git.code.sf.net` zsh source URL that the workflow
uses

## Testing

- `cargo test -p codex-shell-escalation`
- `just argument-comment-lint`
- `bash -n .github/scripts/build-zsh-release-artifact.sh`
- attempted `cargo test -p codex-core`; unrelated existing failures
remain, but the touched `tools::runtimes::shell::unix_escalation::*`
coverage passed during that run

shell-tool-mcp/tests/bashSelection.test.ts

@@ -1,41 +0,0 @@
-import { selectDarwinBash, selectLinuxBash } from "../src/bashSelection";
-import { DARWIN_BASH_VARIANTS, LINUX_BASH_VARIANTS } from "../src/constants";
-import { OsReleaseInfo } from "../src/types";
-import path from "node:path";
-
-describe("selectLinuxBash", () => {
-  const bashRoot = "/vendor/bash";
-
-  it("prefers exact version match when id is present", () => {
-    const info: OsReleaseInfo = {
-      id: "ubuntu",
-      idLike: ["debian"],
-      versionId: "24.04.1",
-    };
-    const selection = selectLinuxBash(bashRoot, info);
-    expect(selection.variant).toBe("ubuntu-24.04");
-    expect(selection.path).toBe(path.join(bashRoot, "ubuntu-24.04", "bash"));
-  });
-
-  it("falls back to first supported variant when no matches", () => {
-    const info: OsReleaseInfo = { id: "unknown", idLike: [], versionId: "1.0" };
-    const selection = selectLinuxBash(bashRoot, info);
-    expect(selection.variant).toBe(LINUX_BASH_VARIANTS[0].name);
-  });
-});
-
-describe("selectDarwinBash", () => {
-  const bashRoot = "/vendor/bash";
-
-  it("selects compatible darwin version", () => {
-    const darwinRelease = "24.0.0";
-    const selection = selectDarwinBash(bashRoot, darwinRelease);
-    expect(selection.variant).toBe("macos-15");
-  });
-
-  it("falls back to first darwin variant when release too old", () => {
-    const darwinRelease = "20.0.0";
-    const selection = selectDarwinBash(bashRoot, darwinRelease);
-    expect(selection.variant).toBe(DARWIN_BASH_VARIANTS[0].name);
-  });
-});