Release 0.119.0-alpha.5

## Why

`external_bearer_only_auth_manager_uses_cached_provider_token` can fail
on Windows when cold `powershell.exe` startup exceeds the provider-auth
helper's 1s timeout. When that happens,
`AuthManager::resolve_external_api_key_auth()` [logs the resolver error
and returns
`None`](https://github.com/openai/codex/blob/024b08b411fe/codex-rs/login/src/auth/manager.rs#L1449-L1455),
which is exactly the assertion failure from the flake.

## What

- Invoke `powershell.exe` explicitly in the Windows provider-auth test
helpers in `login/src/auth/auth_tests.rs`.
- Increase the helper timeout to `10_000` ms and document why that slack
exists.

## Verification

- `cargo test -p codex-login`

MODULE.bazel

@@ -71,6 +71,7 @@ single_version_override(
     patch_strip = 1,
     patches = [
         "//patches:rules_rs_windows_gnullvm_exec.patch",
+        "//patches:rules_rs_delete_git_worktree_pointer.patch",
     ],
     version = "0.0.43",
 )

codex-rs/Cargo.toml

@@ -87,7 +87,7 @@ members = [
 resolver = "2"
 
 [workspace.package]
-version = "0.0.0"
+version = "0.119.0-alpha.5"
 # Track the edition for all workspace crates in one place. Individual
 # crates can still override this value, but keeping it here means new
 # crates created with `cargo new -w ...` automatically inherit the 2024

codex-rs/login/src/auth/auth_tests.rs

@@ -395,7 +395,7 @@ $lines | Select-Object -Skip 1 | Set-Content -Path tokens.txt
 "#,
             )?;
             (
-                "powershell".to_string(),
+                "powershell.exe".to_string(),
                 vec![
                     "-NoProfile".to_string(),
                     "-ExecutionPolicy".to_string(),
@@ -436,7 +436,7 @@ exit 1
 
         #[cfg(windows)]
         let (command, args) = (
-            "powershell".to_string(),
+            "powershell.exe".to_string(),
             vec![
                 "-NoProfile".to_string(),
                 "-ExecutionPolicy".to_string(),
@@ -457,7 +457,9 @@ exit 1
         serde_json::from_value(json!({
             "command": self.command,
             "args": self.args,
-            "timeout_ms": 1000,
+            // `powershell.exe` startup can be slow on loaded Windows CI workers, so leave enough
+            // slack to avoid turning these auth-cache assertions into a process-launch timing test.
+            "timeout_ms": 10_000,
             "refresh_interval_ms": 60000,
             "cwd": self.tempdir.path(),
         }))

patches/rules_rs_delete_git_worktree_pointer.patch

@@ -0,0 +1,20 @@
+diff --git a/rs/private/crate_git_repository.bzl b/rs/private/crate_git_repository.bzl
+--- a/rs/private/crate_git_repository.bzl
++++ b/rs/private/crate_git_repository.bzl
+@@ -35,6 +35,14 @@
+         "HEAD"
+     ])
+     if result.return_code != 0:
+         fail(result.stderr)
+
++    # Remove .git worktree pointer file. It contains an absolute path to
++    # the bazel output base which is machine-specific and non-deterministic.
++    # Leaving it in pollutes compile_data globs and causes AC misses.
++    #
++    # Note that bazelbuild/rules_rust ignores .git (among other paths) during splicing:
++    # https://github.com/bazelbuild/rules_rust/blob/ca4915c0210bcd240152a5333ecb24d266bda144/crate_universe/src/splicing/splicer.rs#L42
++    rctx.delete(root.get_child(".git"))
++
+     if strip_prefix:
+         dest_link = dest_dir.get_child(strip_prefix)
+         if not dest_link.exists: