fix: keep zsh-fork release assets after removing shell-tool-mcp

[bolinfest]

Why

shell-tool-mcp and the Bash fork are no longer needed, but the patched zsh fork is still relevant for shell escalation and for the DotSlash-backed zsh-fork integration tests.

Deleting the old shell-tool-mcp workflow also deleted the only pipeline that rebuilt those patched zsh binaries. This keeps the package removal, while preserving a small release path that can be reused whenever codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch changes.

What changed

• removed the shell-tool-mcp workspace package, its npm packaging/release jobs, the Bash test fixture, and the remaining Bash-specific compatibility wiring
• deleted the old .github/workflows/shell-tool-mcp.yml and .github/workflows/shell-tool-mcp-ci.yml workflows now that their responsibilities have been replaced or removed
• kept the zsh patch under codex-rs/shell-escalation/patches/zsh-exec-wrapper.patch and updated the codex-rs/shell-escalation docs/code to describe the zsh-based flow directly
• added .github/workflows/rust-release-zsh.yml to build only the three zsh binaries that codex-rs/app-server/tests/suite/zsh needs today:
  • aarch64-apple-darwin on macos-15
  • x86_64-unknown-linux-musl on ubuntu-24.04
  • aarch64-unknown-linux-musl on ubuntu-24.04
• extracted the shared zsh build/smoke-test/stage logic into .github/scripts/build-zsh-release-artifact.sh, made that helper directly executable, and now invoke it directly from the workflow so the Linux and macOS jobs only keep the OS-specific setup in YAML
• wired those standalone codex-zsh-*.tar.gz assets into rust-release.yml and added .github/dotslash-zsh-config.json so releases also publish a codex-zsh DotSlash file
• updated the checked-in codex-rs/app-server/tests/suite/zsh fixture comments to explain that new releases come from the standalone zsh assets, while the checked-in fixture remains pinned to the latest historical release until a newer zsh artifact is published
• tightened a couple of follow-on cleanups in codex-rs/shell-escalation: the ExecParams::command comment now describes the shell -c/-lc string more clearly, and the README now points at the same git.code.sf.net zsh source URL that the workflow uses

Testing

• cargo test -p codex-shell-escalation
• just argument-comment-lint
• bash -n .github/scripts/build-zsh-release-artifact.sh
• attempted cargo test -p codex-core; unrelated existing failures remain, but the touched tools::runtimes::shell::unix_escalation::* coverage passed during that run