Use released DotSlash package for argument-comment lint (#15199)

## Why
The argument-comment lint now has a packaged DotSlash artifact from
[#15198](https://github.com/openai/codex/pull/15198), so the normal repo
lint path should use that released payload instead of rebuilding the
lint from source every time.

That keeps `just clippy` and CI aligned with the shipped artifact while
preserving a separate source-build path for people actively hacking on
the lint crate.

The current alpha package also exposed two integration wrinkles that the
repo-side prebuilt wrapper needs to smooth over:
- the bundled Dylint library filename includes the host triple, for
example `@nightly-2025-09-18-aarch64-apple-darwin`, and Dylint derives
`RUSTUP_TOOLCHAIN` from that filename
- on Windows, Dylint's driver path also expects `RUSTUP_HOME` to be
present in the environment

Without those adjustments, the prebuilt CI jobs fail during `cargo
metadata` or driver setup. This change makes the checked-in prebuilt
wrapper normalize the packaged library name to the plain
`nightly-2025-09-18` channel before invoking `cargo-dylint`, and it
teaches both the wrapper and the packaged runner source to infer
`RUSTUP_HOME` from `rustup show home` when the environment does not
already provide it.

After the prebuilt Windows lint job started running successfully, it
also surfaced a handful of existing anonymous literal callsites in
`windows-sandbox-rs`. This PR now annotates those callsites so the new
cross-platform lint job is green on the current tree.

## What Changed
- checked in the current
`tools/argument-comment-lint/argument-comment-lint` DotSlash manifest
- kept `tools/argument-comment-lint/run.sh` as the source-build wrapper
for lint development
- added `tools/argument-comment-lint/run-prebuilt-linter.sh` as the
normal enforcement path, using the checked-in DotSlash package and
bundled `cargo-dylint`
- updated `just clippy` and `just argument-comment-lint` to use the
prebuilt wrapper
- split `.github/workflows/rust-ci.yml` so source-package checks live in
a dedicated `argument_comment_lint_package` job, while the released lint
runs in an `argument_comment_lint_prebuilt` matrix on Linux, macOS, and
Windows
- kept the pinned `nightly-2025-09-18` toolchain install in the prebuilt
CI matrix, since the prebuilt package still relies on rustup-provided
toolchain components
- updated `tools/argument-comment-lint/run-prebuilt-linter.sh` to
normalize host-qualified nightly library filenames, keep the `rustup`
shim directory ahead of direct toolchain `cargo` binaries, and export
`RUSTUP_HOME` when needed for Windows Dylint driver setup
- updated `tools/argument-comment-lint/src/bin/argument-comment-lint.rs`
so future published DotSlash artifacts apply the same nightly-filename
normalization and `RUSTUP_HOME` inference internally
- fixed the remaining Windows lint violations in
`codex-rs/windows-sandbox-rs` by adding the required `/*param*/`
comments at the reported callsites
- documented the checked-in DotSlash file, wrapper split, archive
layout, nightly prerequisite, and Windows `RUSTUP_HOME` requirement in
`tools/argument-comment-lint/README.md`

tools/argument-comment-lint/run.sh

@@ -5,6 +5,7 @@ set -euo pipefail
 repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
 lint_path="$repo_root/tools/argument-comment-lint"
 manifest_path="$repo_root/codex-rs/Cargo.toml"
+toolchain_channel="nightly-2025-09-18"
 strict_lint="uncommented-anonymous-literal-argument"
 noise_lint="unknown_lints"
 
@@ -14,6 +15,42 @@ has_no_deps=false
 has_library_selection=false
 expect_value=""
 
+ensure_local_prerequisites() {
+    if ! command -v cargo-dylint >/dev/null 2>&1 || ! command -v dylint-link >/dev/null 2>&1; then
+        cat >&2 <<EOF
+argument-comment-lint source wrapper requires cargo-dylint and dylint-link.
+Install them with:
+  cargo install --locked cargo-dylint dylint-link
+EOF
+        exit 1
+    fi
+
+    if ! rustup toolchain list | grep -q "^${toolchain_channel}"; then
+        cat >&2 <<EOF
+argument-comment-lint source wrapper requires the ${toolchain_channel} toolchain with rustc-dev support.
+Install it with:
+  rustup toolchain install ${toolchain_channel} \\
+    --component llvm-tools-preview \\
+    --component rustc-dev \\
+    --component rust-src
+EOF
+        exit 1
+    fi
+}
+
+set_default_env() {
+    if [[ "${DYLINT_RUSTFLAGS:-}" != *"$strict_lint"* ]]; then
+        export DYLINT_RUSTFLAGS="${DYLINT_RUSTFLAGS:+${DYLINT_RUSTFLAGS} }-D $strict_lint"
+    fi
+    if [[ "${DYLINT_RUSTFLAGS:-}" != *"$noise_lint"* ]]; then
+        export DYLINT_RUSTFLAGS="${DYLINT_RUSTFLAGS:+${DYLINT_RUSTFLAGS} }-A $noise_lint"
+    fi
+
+    if [[ -z "${CARGO_INCREMENTAL:-}" ]]; then
+        export CARGO_INCREMENTAL=0
+    fi
+}
+
 for arg in "$@"; do
     if [[ -n "$expect_value" ]]; then
         case "$expect_value" in
@@ -62,30 +99,25 @@ for arg in "$@"; do
     esac
 done
 
+lint_args=()
+if [[ "$has_manifest_path" == false ]]; then
+    lint_args+=(--manifest-path "$manifest_path")
+fi
+if [[ "$has_package_selection" == false ]]; then
+    lint_args+=(--workspace)
+fi
+if [[ "$has_no_deps" == false ]]; then
+    lint_args+=(--no-deps)
+fi
+lint_args+=("$@")
+
+ensure_local_prerequisites
+set_default_env
+
 cmd=(cargo dylint --path "$lint_path")
 if [[ "$has_library_selection" == false ]]; then
     cmd+=(--all)
 fi
-if [[ "$has_manifest_path" == false ]]; then
-    cmd+=(--manifest-path "$manifest_path")
-fi
-if [[ "$has_package_selection" == false ]]; then
-    cmd+=(--workspace)
-fi
-if [[ "$has_no_deps" == false ]]; then
-    cmd+=(--no-deps)
-fi
-cmd+=("$@")
-
-if [[ "${DYLINT_RUSTFLAGS:-}" != *"$strict_lint"* ]]; then
-    export DYLINT_RUSTFLAGS="${DYLINT_RUSTFLAGS:+${DYLINT_RUSTFLAGS} }-D $strict_lint"
-fi
-if [[ "${DYLINT_RUSTFLAGS:-}" != *"$noise_lint"* ]]; then
-    export DYLINT_RUSTFLAGS="${DYLINT_RUSTFLAGS:+${DYLINT_RUSTFLAGS} }-A $noise_lint"
-fi
-
-if [[ -z "${CARGO_INCREMENTAL:-}" ]]; then
-    export CARGO_INCREMENTAL=0
-fi
+cmd+=("${lint_args[@]}")
 
 exec "${cmd[@]}"