[codex] Add diagnostic bundle validation tests

[xianxiye]

Summary

Adds deterministic diagnostic bundle validation coverage for the JSON/logd contract and fixes Windows metadata paths to use repository-relative / paths.

Changes

• Added tools/verify_diagnostic_bundle.py to validate diagnostic JSON/logd pairing.
• Added unittest coverage for matching artifacts, chunked artifacts, missing JSON, missing logd references, mismatched pairs, Windows/absolute path rejection, and local path leakage.
• Normalized generated diagnostic metadata paths and decrypt commands to POSIX-style repository-relative paths.
• Documented the validator commands in README.md.

Testing

• python -m py_compile build.py tools\verify_diagnostic_bundle.py tests\test_verify_diagnostic_bundle.py
• python -m unittest discover -s tests -t . -v
• python tools\verify_diagnostic_bundle.py diagnostic\build-00000000.json
• python3 build.py attempted; it stopped at frontend because npm is not installed in this Windows environment.
• python3 build.py -m backend generated the required diagnostic bundle but exited non-zero because cargo is not installed.
• python tools\verify_diagnostic_bundle.py diagnostic\build-0e5a90ec.json

Diagnostics

• diagnostic/build-0e5a90ec.json
• diagnostic/build-0e5a90ec-part001.logd
• diagnostic/build-0e5a90ec-part002.logd
• Password: 5bd4dc9f1b40d989ade8
• Reassemble chunks before unpacking:
  cat diagnostic/build-0e5a90ec-part001.logd diagnostic/build-0e5a90ec-part002.logd > diagnostic/build-0e5a90ec.logd

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

---

• I would like to request that my diagnostic build log is removed before merging