Preserve attachment Unix socket grants when controller policy is omitted (#46004)

## Why

An omitted controller socket policy was treated as an explicit denial, preventing execution environments from supplying their own Unix socket grants.

## What changed

- Preserve omission of `dangerously_allow_all_unix_sockets` separately from `false`, and retain explicitly empty `unix_sockets` maps.
- Defer to attachment socket permissions when the controller supplies neither setting. Continue enforcing explicit restrictions, socket denials, and managed requirements.
- Resolve omitted values to `false` for ordinary execution and remote configuration, preserving the default for commands without attachment grants.
- Add debug logging for effective environment and remote execution network policies.

## Testing

Add regression coverage for omitted, explicit, finite, empty, and managed socket policies through remote launch configuration, including live policy replacement and serialization round trips. Adjust remote environment tests to tolerate child-completion ordering and box large cold-resume test futures to reduce Windows stack usage.

GitOrigin-RevId: 98a88d01cbb91aea1faaa03b3c414ef3be7af398

codex-rs/network-proxy/src/runtime.rs

@@ -786,7 +786,11 @@ impl NetworkProxyState {
         }
 
         let guard = self.state.read().await;
-        if guard.config.dangerously_allow_all_unix_sockets {
+        if guard
+            .config
+            .dangerously_allow_all_unix_sockets
+            .unwrap_or(false)
+        {
             return Ok(true);
         }
 
@@ -2038,7 +2042,7 @@ mod tests {
 
         let config = NetworkProxyConfig {
             enabled: true,
-            dangerously_allow_all_unix_sockets: true,
+            dangerously_allow_all_unix_sockets: Some(true),
             ..NetworkProxyConfig::default()
         };
 
@@ -2055,7 +2059,7 @@ mod tests {
 
         let config = NetworkProxyConfig {
             enabled: true,
-            dangerously_allow_all_unix_sockets: true,
+            dangerously_allow_all_unix_sockets: Some(true),
             ..NetworkProxyConfig::default()
         };
 
@@ -2071,7 +2075,7 @@ mod tests {
 
         let config = NetworkProxyConfig {
             enabled: true,
-            dangerously_allow_all_unix_sockets: true,
+            dangerously_allow_all_unix_sockets: Some(true),
             ..NetworkProxyConfig::default()
         };
 
@@ -2084,7 +2088,7 @@ mod tests {
 
         let config = NetworkProxyConfig {
             enabled: true,
-            dangerously_allow_all_unix_sockets: true,
+            dangerously_allow_all_unix_sockets: Some(true),
             ..NetworkProxyConfig::default()
         };
 
@@ -2244,7 +2248,7 @@ mod tests {
     async fn unix_socket_allow_all_flag_bypasses_allowlist() {
         let state = network_proxy_state_for_policy({
             let mut network = network_settings(&["example.com"], &[]);
-            network.dangerously_allow_all_unix_sockets = true;
+            network.dangerously_allow_all_unix_sockets = Some(true);
             network
         });
 
@@ -2262,7 +2266,7 @@ mod tests {
                 &[],
                 std::slice::from_ref(&socket_path),
             );
-            network.dangerously_allow_all_unix_sockets = true;
+            network.dangerously_allow_all_unix_sockets = Some(true);
             network
         });