Workspace lints and disallow unwrap (#855)

Sets submodules to use workspace lints. Added denying unwrap as a
workspace level lint, which found a couple of cases where we could have
propagated errors. Also manually labeled ones that were fine by my eye.

codex-rs/exec/Cargo.toml

@@ -11,6 +11,9 @@ path = "src/main.rs"
 name = "codex_exec"
 path = "src/lib.rs"
 
+[lints]
+workspace = true
+
 [dependencies]
 anyhow = "1"
 chrono = "0.4.40"