Workspace lints and disallow unwrap (#855)

Sets submodules to use workspace lints. Added denying unwrap as a
workspace level lint, which found a couple of cases where we could have
propagated errors. Also manually labeled ones that were fine by my eye.

codex-rs/Cargo.toml

@@ -22,6 +22,12 @@ version = "0.0.0"
 # edition.
 edition = "2024"
 
+[workspace.lints]
+rust = { }
+
+[workspace.lints.clippy]
+unwrap_used = "deny"
+
 [profile.release]
 lto = "fat"
 # Because we bundle some of these executables with the TypeScript CLI, we