[codex] Update upstream parity for v0.86.0

[jooh]

Summary

• bump the pinned upstream/ submodule from v0.85.0 to v0.86.0
• refresh upstream-derived baselines and docs for the new pinned commit
• restore native parity for the upstream lockfile, metadata-label, and Windows default-id-label changes

Why

Upstream moved to v0.86.0, which introduced behavior changes that affected this Rust port's compatibility surface. In particular, parity drift showed up in three areas:

• lockfile writers now use a canonical trailing-newline format and frozen mode reports a missing lockfile explicitly
• devcontainer.metadata is now always written as a JSON array, even for a single entry
• Windows default devcontainer.local_folder / devcontainer.config_file labels normalize drive-letter casing and path shape during container lookup

Without these updates, the repo would point at the new upstream release while still diverging in observable runtime behavior and compatibility tracking artifacts.

Impact

• frozen lockfile checks now match upstream semantics more closely
• metadata labels written by the native runtime match the upstream JSON array shape while remaining backward-compatible with legacy object labels on read
• Windows container reuse is more tolerant of legacy/default label mismatches caused by drive-letter casing and separator differences
• compatibility baselines, command metadata, parity inventory, and upstream test coverage docs now track the pinned v0.86.0 commit

Validation

• cargo test --manifest-path cmd/devcontainer/Cargo.toml --lib
• upstream drift checks for command matrix, CLI metadata, CLI reference, parity inventory, compatibility dashboard, TODO args, upstream compatibility, and upstream test coverage
• make rust-tests
• make tests