Workspace lints and disallow unwrap (#855)

Sets submodules to use workspace lints. Added denying unwrap as a
workspace level lint, which found a couple of cases where we could have
propagated errors. Also manually labeled ones that were fine by my eye.

codex-rs/apply-patch/Cargo.toml

@@ -7,6 +7,9 @@ edition = "2024"
 name = "codex_apply_patch"
 path = "src/lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = "1"
 regex = "1.11.1"

codex-rs/apply-patch/src/lib.rs

@@ -223,7 +223,9 @@ fn extract_heredoc_body_from_apply_patch_command(src: &str) -> anyhow::Result<St
     loop {
         let node = c.node();
         if node.kind() == "heredoc_body" {
-            let text = node.utf8_text(bytes).unwrap();
+            let text = node
+                .utf8_text(bytes)
+                .with_context(|| "failed to interpret heredoc body as UTF-8")?;
             return Ok(text.trim_end_matches('\n').to_owned());
         }
 
@@ -605,6 +607,8 @@ pub fn print_summary(
 
 #[cfg(test)]
 mod tests {
+    #![allow(clippy::unwrap_used)]
+
     use super::*;
     use pretty_assertions::assert_eq;
     use std::fs;