fix(raw): update security dependencies for 0.1.1

[bproject07]

Summary

• bump Codex Raw to 0.1.1
• update the Raw runtime closure for patched gix, JWT, OpenTelemetry, serde_with, tar, and Linux OpenSSL releases
• adapt OTLP HTTP transport to reqwest 0.13 while preserving custom-CA-only TLS behavior
• refresh Cargo and Bazel dependency locks and update installation/release documentation

Security scope

The four supported release targets were audited independently. The updated dependency versions have no matching GitHub advisories.

hickory-proto 0.25.2 remains transitively pinned by rama 0.3.0-alpha.4. Its high-severity NSEC3 advisory is feature-unreachable because Codex Raw does not enable DNSSEC; the medium CPU-DoS advisory remains potentially reachable. Resolving it requires a separate breaking Rama API/toolchain migration, not a lockfile-only update. The changelog states this explicitly.

This PR does not change rust-toolchain.toml; Dependabot PR #1 remains separate.

Verification

• cargo +1.95.0-x86_64-pc-windows-gnu check --locked --package codex-raw
• cargo test --locked -p codex-otel (15 unit + 35 integration tests)
• Bazel 9.0.0: bazel mod deps --lockfile_mode=error
• dependency closure audit for Windows x64, Linux x64, Linux ARM64, and macOS Intel
• staged diff and added-line secret scan

Final release binaries are intentionally built only by GitHub Actions after the protected release tag is created.