[codex] Align Bazel opt mode with Cargo release

[anp-oai]

Why

Bazel release binaries should use the same optimization and debug behavior as Cargo's release profile. Keeping those semantics attached to Bazel's standard opt mode avoids a second release-only flag list that can drift.

What changed

Patch the pinned rules_rust dependency so target-side opt builds use Cargo-compatible optimization, ThinLTO, debug info, stripping, split debug info, and codegen-unit defaults. Exec-side build scripts and proc macros retain Cargo's cheaper build-override defaults, while explicit upstream LTO and codegen-unit settings still take precedence.

Update the shared release-binaries config to select only opt.

Validation

• Ran just build-for-release under RBE and produced all six release outputs.
• Used Bazel action queries to verify target flags, exec-side flags, and explicit override precedence.
• Ran just bazel-lock-check.

Stack: 8 of 8. Depends on #27456.

[anp-oai]

is it possible for us to achieve the same outcome for the production binaries without patching rules_rust? it's ok if we don't get the same subtlety in the exec configuration as we'd like