Workspace lints and disallow unwrap (#855)

Sets submodules to use workspace lints. Added denying unwrap as a
workspace level lint, which found a couple of cases where we could have
propagated errors. Also manually labeled ones that were fine by my eye.

codex-rs/execpolicy/src/policy_parser.rs

@@ -168,6 +168,8 @@ fn policy_builtins(builder: &mut GlobalsBuilder) {
                 .map(|v| v.items.to_vec())
                 .collect(),
         );
+
+        #[expect(clippy::unwrap_used)]
         let policy_builder = eval
             .extra
             .as_ref()
@@ -182,6 +184,7 @@ fn policy_builtins(builder: &mut GlobalsBuilder) {
         strings: UnpackList<String>,
         eval: &mut Evaluator,
     ) -> anyhow::Result<NoneType> {
+        #[expect(clippy::unwrap_used)]
         let policy_builder = eval
             .extra
             .as_ref()
@@ -197,6 +200,7 @@ fn policy_builtins(builder: &mut GlobalsBuilder) {
         reason: String,
         eval: &mut Evaluator,
     ) -> anyhow::Result<NoneType> {
+        #[expect(clippy::unwrap_used)]
         let policy_builder = eval
             .extra
             .as_ref()