Fix cargo-deny failure for tar RUSTSEC-2026-0068

[dzianisv]

Summary

cargo-deny is currently failing on main and PR branches because codex-package-manager pulls in tar 0.4.44, which is flagged by RUSTSEC-2026-0068.

Evidence

• failing main workflow: cargo-deny run 23563742907
• failing PR workflow example: cargo-deny run 23590629513
• advisory: RUSTSEC-2026-0068
• suggested remediation from CI: upgrade to tar >= 0.4.45

Notes

This is repository-wide CI breakage, not specific to PR #42.

[dzianisv]

Status update (2026-03-26):

I rechecked this against current fork and upstream state. This is still a fork-side dependency/config drift issue, not something introduced by PR #42.

Current evidence:

• fork main cargo-deny run 23563742907 still fails
• upstream main cargo-deny is currently green (23606147608, also 23604059494 and 23603673025)
• our codex-rs/Cargo.lock still differs from upstream: upstream has tar 0.4.45, our fork has tar 0.4.44
• current fork logs also show additional AWS-LC advisories (RUSTSEC-2026-0044..0049) and stale deny.toml ignore config, so the problem is broader than just the original tar advisory text in this issue

Most likely fix: sync codex-rs/Cargo.lock and codex-rs/deny.toml back toward upstream instead of applying a one-off tar-only patch.