[codex] Remove async_trait from first-party code

[anp-oai]

Why

First-party async traits should expose their Send contracts explicitly without requiring async_trait. This completes the migration pattern established in #27303 and #27304.

What changed

• Replaced the remaining first-party async_trait traits with native return-position impl Future + Send where statically dispatched and explicit boxed Send futures where object safety is required.
• Kept implementations behavior-preserving, outlining existing async bodies into inherent methods where that keeps the diff reviewable.
• Removed all direct first-party async-trait dependencies and the workspace dependency declaration.
• Added a cargo-deny policy that permits async-trait only through the remaining transitive wrapper crates.
• Updated rand from 0.8.5 to 0.8.6 to resolve RUSTSEC-2026-0097 and keep the full cargo-deny check passing.

Validation

• just test -p codex-exec-server: 216 passed, 2 skipped.
• just test -p codex-model-provider: 39 passed.
• just test -p codex-core and just test: changed tests passed; remaining failures are environment-sensitive suites unrelated to this migration.
• cargo deny check
• just fix
• just fmt
• cargo shear
• just bazel-lock-check

[bolinfest]

Thanks for getting this cleanup over the finish line!