fix(core): fix panic after codex is updated with npm

[Electroid]

Closes #3051
Closes #4754
Closes #5098
Closes #2928

Summary

Users have been reporting panics when Codex uses the apply_patch tool.

✘ Failed to apply patch
  └ 
    thread 'main' panicked at linux-sandbox/src/linux_run_main.rs:53:5:
    Failed to execvp ../lib/node_modules/@openai/.codex-{}/bin/codex-{}
    (deleted): No such file or directory (os error 2)

When you look at the stacktrace, the error is deceptively simple: the Codex binary doesn't exist. However, the root cause is more involved.

When you install or update Codex using npm/bun, the package manager uses a temporary directory mechanism:

On install: npm install -g @openai/codex

/usr/local/
├── bin/
│   └── codex -> ../lib/node_modules/@openai/.codex-{hash1}/bin/codex
└── lib/
    └── node_modules/
        └── @openai/
            └── .codex-{hash1}/
                ├── bin/
                │   └── codex <- Existing Codex holds a reference to this path
                └── ...

On upgrade: npm install -g @openai/codex@latest

/usr/local/
├── bin/
│   └── codex -> ../lib/node_modules/@openai/.codex-{hash2}/bin/codex (updated)
└── lib/
    └── node_modules/
        └── @openai/
            ├── .codex-{hash1}/ <- Existing Codex holds a reference to a (deleted) binary
            │   └── (deleted)
            └── .codex-{hash2}/ <- Future Codex holds a reference to the (correct) binary
                ├── bin/
                │   └── codex
                └── ...

Why is this not a problem with other Node.js <> Rust CLIs? It is! But the error rate is more pronounced in Codex because:

• Users can have multiple instances of Codex open for hours, if not days.
• Codex invokes itself for features like apply_patch and the Linux sandbox.

Reproduction

In the Codex repository:

1. cargo run --manifest-path codex-rs/Cargo.toml -p codex-tui --bin codex-tui --
2. rm codex-rs/target/debug/codex-tui
3. Ask Codex: "write a hello.md file with "hello" use apply_patch"

Solution

There isn't a lot you can do to prevent this bug from occuring. Instead, we can do some work in Codex to make the failure mode more graceful and informative. (rather than an obscure panic and "not found")

Happy path: Binary was deleted, but another Codex exists on PATH.

Sad path: Binary was deleted, and no alternative exists on PATH.

[etraut-openai]

Thanks for the contribution. I see that you've marked this as a draft PR. Once you think it's ready for review, please take it out of draft status.