Support Windows sandboxing in the exec server (#34423)

## Why

Sandboxed process launch through the exec server was unsupported on Windows.

## What changed

- Add a shared native process launcher that selects the Windows sandbox session backend when required and otherwise launches PTY or pipe-based processes.
- Pass Windows permission, workspace-root, proxy, filesystem-override, and desktop settings through exec-server process preparation.
- Preserve piped stdin and inherited file descriptors across the shared launch path.

## Testing

- Verify that a remote Windows sandbox process accepts stdin while blocking a write under a read-only policy.
- Enable workspace-root sandbox tests on native Windows while continuing to skip environments that cannot emulate Windows sandbox semantics.

GitOrigin-RevId: 6719ccbe87ad0d5a57af56503e3f23f894c60a71

codex-rs/exec-server/src/process_sandbox_tests.rs

@@ -7,7 +7,9 @@ use codex_network_proxy::ManagedNetworkSandboxContext;
 use codex_network_proxy::NetworkProxyConfig;
 use codex_network_proxy::RemoteNetworkProxyConfig;
 use codex_network_proxy::RemoteNetworkProxyLaunchConfig;
-#[cfg(unix)]
+#[cfg(windows)]
+use codex_protocol::config_types::WindowsSandboxLevel;
+#[cfg(any(unix, windows))]
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_path_uri::PathUri;
@@ -18,9 +20,9 @@ use tokio::time::timeout;
 
 use super::prepare_exec_request;
 use crate::ExecParams;
-#[cfg(unix)]
+#[cfg(any(unix, windows))]
 use crate::ExecServerRuntimePaths;
-#[cfg(unix)]
+#[cfg(any(unix, windows))]
 use crate::FileSystemSandboxContext;
 use crate::ProcessId;
 
@@ -272,3 +274,50 @@ async fn disabled_remote_proxy_config_is_rejected_before_exporting_ports() {
             .contains("executor-local network proxy launch requires an enabled proxy")
     );
 }
+
+#[cfg(windows)]
+#[tokio::test]
+async fn managed_network_selects_elevated_windows_spawn() {
+    let cwd: AbsolutePathBuf = std::env::current_dir()
+        .expect("current directory")
+        .try_into()
+        .expect("absolute cwd");
+    let cwd_uri = PathUri::from_abs_path(&cwd);
+    let self_exe = std::env::current_exe().expect("current executable");
+    let runtime_paths = ExecServerRuntimePaths::new(self_exe, None).expect("runtime paths");
+    let permissions = PermissionProfile::read_only();
+    let mut sandbox = FileSystemSandboxContext::from_permission_profile_with_cwd(
+        permissions.clone(),
+        cwd_uri.clone(),
+    );
+    sandbox.windows_sandbox_level = WindowsSandboxLevel::RestrictedToken;
+    let params = ExecParams {
+        process_id: ProcessId::from("process-managed-network"),
+        argv: vec!["cmd.exe".to_string(), "/c".to_string(), "exit".to_string()],
+        cwd: cwd_uri,
+        env_policy: None,
+        env: HashMap::new(),
+        tty: false,
+        pipe_stdin: false,
+        arg0: None,
+        sandbox: Some(sandbox),
+        enforce_managed_network: true,
+        managed_network: None,
+        network_proxy: None,
+    };
+
+    let prepared = prepare_exec_request(&params, HashMap::new(), Some(&runtime_paths))
+        .await
+        .expect("prepare sandboxed request");
+    let spawn = prepared
+        .windows_sandbox_spawn_request()
+        .expect("Windows sandbox spawn request");
+
+    assert_eq!(
+        spawn.windows_sandbox_level,
+        WindowsSandboxLevel::RestrictedToken
+    );
+    assert!(spawn.proxy_enforced);
+    assert_eq!(spawn.permission_profile, &permissions);
+    assert_eq!(spawn.workspace_roots, std::slice::from_ref(&cwd));
+}