fix(deps): repair Rust dependency train

[andrei-hasna]

Summary

• consolidate the PR0 Rust dependency train for fix(deps): bump crossbeam-epoch to 0.9.20 (RUSTSEC-2026-0204) #174, chore(deps): bump os_info from 3.14.0 to 3.15.0 in /codex-rs #194, chore(deps): bump rustls from 0.23.36 to 0.23.41 in /codex-rs #195, chore(deps): bump chardetng from 0.1.17 to 1.0.0 in /codex-rs #196, chore(deps): bump whoami from 1.6.1 to 2.1.2 in /codex-rs #197, and chore(deps): bump constant_time_eq from 0.3.1 to 0.5.0 in /codex-rs #198 onto current main
• bump crossbeam-epoch to 0.9.20 to clear RUSTSEC-2026-0204 and the cargo-deny blocker affecting ci: repair GitHub Actions dependency train #206
• update os_info, rustls, chardetng, whoami, and constant_time_eq lock/manifests, regenerate MODULE.bazel.lock
• add minimal source compatibility for chardetng 1.0 and whoami 2.x API changes

Supersedes stale/duplicate dependency PRs #174, #193, #194, #195, #196, #197, and #198. #193 remains a close/supersede candidate because it duplicates the crossbeam bump, includes unrelated non-dependency edits, and has a prohibited Co-Authored-By trailer in its existing commit.

Validation

• cargo check --locked -p codex-protocol -p codex-app-server-transport -p codex-core -p codex-client -p codex-analytics -p codex-cli
• cargo deny check
• bazel --output_user_root=/tmp/codewith-pr0-wave2-bazel-output mod deps --disk_cache=/tmp/codewith-pr0-wave2-bazel-disk-cache --repo_contents_cache=/tmp/codewith-pr0-wave2-bazel-repo-contents-cache --repository_cache=/tmp/codewith-pr0-wave2-bazel-repo-cache --lockfile_mode=error
• cargo test --locked -p codex-protocol exec_output
• cargo test --locked -p codex-core prepare_realtime_backend_prompt
• cargo fmt --check
• git diff --check
• gitleaks protect --staged --redact --no-banner
• gitleaks detect --redact --no-banner --log-opts origin/main..HEAD
• trailer checks for Co-Authored-By/Signed-off-by: none

Note: local git hook reported lefthook missing during commit/push, so explicit local gates above were run and recorded.

[andrei-hasna]

Adversarial verification update:

• Native codewith review --base origin/main completed on this branch.
• Reviewer conclusion: no actionable regressions found in changed dependency versions or the chardetng/whoami API adaptations; lockfiles and call sites appear consistent with the new crate APIs.
• Reviewer also ran: just check-fast -p codex-protocol PASS, just check-fast -p codex-core PASS, just bazel-lock-check PASS, and cargo deny check PASS.
• Residual local-test note: reviewer attempted broad just test-fast -p codex-core realtime_conversation; it exited 100 with many realtime timeout failures. Reviewer did not classify that as an actionable regression from this dependency PR. Hosted CI is still the merge gate.

This PR should not be merged until hosted checks finish cleanly.

[andrei-hasna]

Superseded by current-main replacement #253. The replacement retains the still-relevant dependency/API updates, excludes the already-landed state BUILD fixture, and adds the required terminal-output and deterministic-fallback regressions.