[exec-server] serve websockets via HTTP upgrade

[euroelessar]

Why

codex exec-server currently exposes a raw websocket listener. Serving the websocket over an HTTP upgrade route makes it compatible with intermediate HTTP proxies and lets the same listener expose ordinary HTTP health endpoints.

What changed

• move the websocket endpoint to ws://<addr>/ws using an HTTP upgrade route
• serve GET /, GET /readyz, and GET /healthz from the same listener
• route accepted Axum websocket connections through the existing JSON-RPC connection machinery without duplicating the websocket pump
• initialize the rustls crypto provider before websocket client connections
• update helper scripts and exec-server URL fixtures to use the /ws endpoint
• add integration coverage for health routes and binary websocket JSON-RPC frames

Verification

• cargo test -p codex-exec-server --test health --test process --test websocket --test initialize --test exec_process
• cargo test -p codex-app-server-protocol environment_add
• cargo test -p codex-core environment_selection
• cargo test -p codex-app-server-client runtime_start_args_forward_environment_manager
• cargo test -p codex-app-server turn_start_resolves_sticky_thread_local_environment_and_turn_overrides
• cargo test -p codex-tui config_cwd_for_app_server_target_omits_cwd_for_remote_exec_server
• cargo test -p codex-exec-server reaches unrelated file_system sandbox-helper failures in this environment after the websocket tests pass