tests(js_repl): stabilize CI runtime test execution

[fjord-oai]

Summary

Stabilize js_repl runtime test execution in CI and move tool-facing js_repl behavior coverage into the integration test suite.

This is a test/CI change only; no production js_repl behavior change is intended.

Why

1. Bazel test sandboxes (especially on macOS) could resolve a different node than the one installed by actions/setup-node, causing js_repl runtime/version failures.
2. js_repl runtime tests can be flaky on Windows when too many Node kernels cold-start concurrently.
3. Several js_repl tests in the unit-test module were actually black-box/tool-level behavior tests and fit better in the integration suite.

Changes

• Add actions/setup-node to the Bazel and Rust Tests workflows using the exact version pinned by codex-rs/node-version.txt (no check-latest).
• In Bazel (non-Windows), pass CODEX_JS_REPL_NODE_PATH=$(which node) into test env so js_repl uses the actions/setup-node runtime inside Bazel tests.
• Add a nextest test group with max-threads = 1 for js_repl runtime tests to avoid concurrent Node-kernel startup timeout bursts (including suite::js_repl::* and the view_image js_repl path).
• Add a new integration test suite for js_repl tool behavior in codex-rs/core/tests/suite/js_repl.rs and register it in codex-rs/core/tests/suite/mod.rs.
• Move tool-facing behavior coverage into the suite (persistence/TLA, builtin tool invocation, recursive self-call rejection, process global isolation, blocked builtin imports).
• Keep white-box manager/kernel tests in codex-rs/core/src/tools/js_repl/mod.rs, with test setup using constrained policy setters and DangerFullAccess where sandbox dispatch behavior is not under test.
• Auto-skip the new suite::js_repl::* tests when no Node runtime is available.

Impact

• Reduces js_repl CI false negatives caused by Node resolution drift and Windows concurrency timeouts.
• Improves test organization by separating black-box tool behavior tests from white-box manager/kernel tests.

git stack

• 👉 1 tests(js_repl): stabilize CI runtime test execution #12407
• ⏳ 2 feat: update Docker image digest to reflect #12205 #12372
• ⏳ 3 tests(js_repl): remove node-related skip paths from js_repl tests #12185
• ⏳ 4 Add feature-gated js_repl polling flow #10673

[bolinfest]

I did not know about this config file! Clearly I missed #6612.