Route exec-server HTTP through configured proxy policy (#35023)

## Why

Delegated HTTP requests need to honor the same outbound proxy policy as the
Codex process that starts the exec server.

## What changed

- Pass the configured `HttpClientFactory` through local and remote exec-server
  startup and use route-aware client pools for delegated HTTP and local MCP
  requests.
- Preserve per-request timeouts and follow-or-stop redirect behavior while
  keeping request URLs and sensitive response headers out of diagnostics.

## Testing

- Cover configured system-proxy routing across the exec-server transport.
- Cover both redirect policies and verify that success and failure logs do not
  expose request or response secrets.

GitOrigin-RevId: 4af6aec1d265c4db62dfcb6e1fb076fb31736137

codex-rs/exec-server/src/server.rs

@@ -13,12 +13,20 @@ pub use transport::ExecServerListenUrlParseError;
 
 use crate::ExecServerRuntimePaths;
 use crate::ExecServerTelemetry;
+use codex_http_client::HttpClientFactory;
 
 pub async fn run_main(
     listen_url: &str,
     runtime_paths: ExecServerRuntimePaths,
+    http_client_factory: HttpClientFactory,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    run_main_with_telemetry(listen_url, runtime_paths, ExecServerTelemetry::default()).await
+    run_main_with_telemetry(
+        listen_url,
+        runtime_paths,
+        ExecServerTelemetry::default(),
+        http_client_factory,
+    )
+    .await
 }
 
 #[tracing::instrument(
@@ -30,12 +38,15 @@ pub async fn run_main_with_telemetry(
     listen_url: &str,
     runtime_paths: ExecServerRuntimePaths,
     telemetry: ExecServerTelemetry,
+    http_client_factory: HttpClientFactory,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    transport::run_transport(listen_url, runtime_paths, telemetry).await
+    transport::run_transport(listen_url, runtime_paths, telemetry, http_client_factory).await
 }
 
 #[cfg(test)]
 mod tests {
+    use codex_http_client::HttpClientFactory;
+    use codex_http_client::OutboundProxyPolicy;
     use opentelemetry::trace::TracerProvider as _;
     use opentelemetry_sdk::trace::InMemorySpanExporter;
     use opentelemetry_sdk::trace::SdkTracerProvider;
@@ -65,6 +76,7 @@ mod tests {
                 )
                 .expect("runtime paths"),
                 ExecServerTelemetry::default(),
+                HttpClientFactory::new(OutboundProxyPolicy::ReqwestDefault),
             )
             .await
             .expect_err("invalid listen URL should fail");