packaging: move rg manifest out of npm bin

[bolinfest]

Why

Installing @openai/codex currently places a Dotslash rg manifest at node_modules/@openai/codex/bin/rg, even though the native optional dependency already ships the actual helper under vendor/<target>/codex-path/rg. The launcher prepends that codex-path directory, so the top-level bin/rg file is redundant in the npm install.

The remaining direct consumers of the manifest are package-building paths: scripts/codex_package/ripgrep.py and codex-cli/scripts/install_native_deps.py. Keeping the manifest under codex-cli/bin makes it look like a shipped npm binary, so this moves it next to the package-builder code that owns it. The checked-in @openai/codex package metadata should likewise describe only the meta package payload; generated platform packages continue to publish vendor.

What Changed

• Moved the Dotslash ripgrep manifest from codex-cli/bin/rg to scripts/codex_package/rg.
• Updated the package builder, npm native-artifact hydrator, README, and CLI help text to reference the new manifest location.
• Stopped codex-cli/scripts/build_npm_package.py from copying rg into the @openai/codex meta package.
• Narrowed the checked-in meta package files whitelist to bin/codex.js.

Verification

• python3 -m unittest discover -s scripts/codex_package -p "test_*.py"
• python3 -m unittest discover -s codex-cli/scripts -p "test_*.py"
• python3 -m py_compile codex-cli/scripts/build_npm_package.py codex-cli/scripts/install_native_deps.py scripts/codex_package/ripgrep.py scripts/codex_package/cli.py scripts/stage_npm_packages.py
• codex-cli/scripts/build_npm_package.py --package codex --version 0.0.0-test --pack-output <tmp>/codex-meta-no-vendor.tgz
• tar -tf <tmp>/codex-meta-no-vendor.tgz showed only package/bin/codex.js, package/package.json, and package/README.md.
• Direct staging check showed codex uses files: ["bin/codex.js"] while codex-darwin-arm64 still uses files: ["vendor"].

---

Stack created with Sapling. Best reviewed with ReviewStack.

• npm: remove legacy package artifact synthesis #23836
• -> packaging: move rg manifest out of npm bin #23833