Workspace lints and disallow unwrap (#855)

Sets submodules to use workspace lints. Added denying unwrap as a
workspace level lint, which found a couple of cases where we could have
propagated errors. Also manually labeled ones that were fine by my eye.

codex-rs/cli/Cargo.toml

@@ -15,6 +15,9 @@ path = "src/linux-sandbox/main.rs"
 name = "codex_cli"
 path = "src/lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = "1"
 clap = { version = "4", features = ["derive"] }