Nix build fails: windows-sandbox-rs manifest/lock mismatch (windows ^0.58 and missing winres)

What version of Codex is running?

0.69.0

What subscription do you have?

plus

Which model were you using?

_No response_

What platform is your computer?

NixOS (Linux 6.12.60 x86_64 unknown)

What issue are you seeing?

nix build .#codex-rs currently fails because codex-rs/windows-sandbox-rs/Cargo.toml now depends on windows = "0.58" (after commit 13c0919bffbed9279ba8b7c1060a565f60da3e3c) and adds a build dependency winres = "0.1", but codex-rs/Cargo.lock only contains windows 0.61.3 and has no winres entry, so the Nix build (which vendors the lock and runs cargo --offline) can’t resolve those dependencies.

What steps can reproduce the bug?

1. Update latest from main.
2. Run nix build .#codex-rs.
3. First failure:

> error: failed to select a version for the requirement `windows = "^0.58"`
> candidate versions found which didn't match: 0.61.3
> location searched: directory source `/build/cargo-vendor-dir` (which is replacing registry `crates-io`)
> required by package `codex-windows-sandbox v0.0.0 (/build/codex-rs/windows-sandbox-rs)`
> perhaps a crate was updated and forgotten to be re-vendored?

1. After bumping windows locally, second failure:

> error: no matching package found
> searched package name: `winres`
> perhaps you meant:      winreg, dirs, winapi, ...
> location searched: directory source `/build/cargo-vendor-dir` (which is replacing registry `crates-io`)
> required by package `codex-windows-sandbox v0.0.0 (/build/codex-rs/windows-sandbox-rs)`

What is the expected behavior?

_No response_

Additional information

These errors only surface after #7863 is addressed.