build: pin codex-apply-patch to openai/codex rust-v0.43.0

[noa-lucent]

This PR pins codex-apply-patch to a stable commit/tag to avoid drift from main and improve release reproducibility (tracking issue #10).

Changes:

• Cargo.toml: replace branch = "main" with pinned commit rev = "a23c1949727a72dbed0c630048a5a1a353eb9168" (tag rust-v0.43.0).
• Cargo.lock: updated accordingly.

Why:

• Pinning avoids unintentional dependency drift from the main branch of https://github.com/openai/codex and aligns with our release reproducibility goals.

References:

• Tag: https://github.com/openai/codex/releases/tag/rust-v0.43.0

CI:

• No toolchain changes. Should build on Rust 1.90.0 across our matrix.

Acceptance:

• cargo tree -i codex-apply-patch should show the git source at the specified commit.

[noa-lucent]

Left comments inline. Main blocker: add version = "=0.43.0" to the codex-apply-patch dependency and refresh Cargo.lock so CI with --locked can resolve to the crate version exposed at the pinned rev. Once CI is green across ubuntu/macos/windows with Rust 1.90.0, I'm happy to approve.