syntax-highlight bash lines (#3142)

i'm not yet convinced i have the best heuristics for what to highlight,
but this feels like a useful step towards something a bit easier to
read, esp. when the model is producing large commands.

<img width="669" height="589" alt="Screenshot 2025-09-03 at 8 21 56 PM"
src="https://github.com/user-attachments/assets/b9cbcc43-80e8-4d41-93c8-daa74b84b331"
/>

also a fairly significant refactor of our line wrapping logic.

codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__binary_size_ideal_response.snap

@@ -1,5 +1,6 @@
 ---
 source: tui/src/chatwidget/tests.rs
+assertion_line: 648
 expression: visible_after
 ---
 > I’m going to scan the workspace and Cargo manifests to see build profiles and
@@ -22,9 +23,9 @@ expression: visible_after
 
   Main Causes
 
-  - Static linking style: Each bin (codex, codex-tui, codex-exec,
-  codex-mcp-server, etc.) statically links its full dependency graph, so common
-  code isn’t shared at runtime across executables.
+  - Static linking style: Each bin (codex, codex-tui, codex-exec, codex-mcp-
+  server, etc.) statically links its full dependency graph, so common code isn’t
+  shared at runtime across executables.
   - Heavy deps (HTTP/TLS): reqwest brings in Hyper, HTTP/2, compressors,
   and a TLS stack (rustls by default; OpenSSL on musl). In core, login, tui,
   and ollama you enable reqwest with json/stream, which still pulls a large
@@ -39,9 +40,9 @@ expression: visible_after
   per bin.
   - Panic + backtraces: Default panic = unwind and backtrace support keep
   unwinding tables and symbols that add weight.
-  - Per-target OpenSSL (musl): For *-unknown-linux-musl, core enables
-  openssl-sys with vendored, compiling OpenSSL into the binary—this adds
-  multiple megabytes per executable.
+  - Per-target OpenSSL (musl): For *-unknown-linux-musl, core enables openssl-
+  sys with vendored, compiling OpenSSL into the binary—this adds multiple
+  megabytes per executable.
 
   Build-Mode Notes
 
@@ -52,6 +53,6 @@ expression: visible_after
   - Debug builds: cargo build (dev profile) includes full debuginfo, no LTO, and
   assertions—outputs are much larger than cargo build --release.
 
-  If you want, I can outline targeted trims (e.g., strip = "debuginfo",
-  opt-level = "z", panic abort, tighter tokio/reqwest features) and estimate
-  impact per binary.
+  If you want, I can outline targeted trims (e.g., strip = "debuginfo", opt-
+  level = "z", panic abort, tighter tokio/reqwest features) and estimate impact
+  per binary.