Add network policy metadata to environment configuration (#39055)

## What changed

- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
  Unix-socket, upstream-proxy, and local-binding restrictions without exposing
  controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
  the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
  readiness until runtime enforcement is implemented, while preserving the
  existing controller policy when the field is absent.

## Testing

- Cover rejection through both environment preview and readiness, including
  preservation of the existing environment selection.

GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80

codex-rs/network-proxy/src/environment_policy.rs

@@ -0,0 +1,34 @@
+use crate::NetworkDomainPermissions;
+use crate::NetworkProxyConfig;
+use crate::NetworkUnixSocketPermissions;
+use serde::Deserialize;
+use serde::Serialize;
+
+/// Traffic restrictions supplied by the owner of one execution environment.
+///
+/// Proxy enablement, listeners, network mode, MITM, and credentials remain owned by the
+/// controller's network-proxy runtime.
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EnvironmentNetworkPolicy {
+    pub domains: Option<NetworkDomainPermissions>,
+    pub unix_sockets: Option<NetworkUnixSocketPermissions>,
+    pub allow_upstream_proxy: bool,
+    pub dangerously_allow_all_unix_sockets: bool,
+    pub allow_local_binding: bool,
+    pub managed_allowed_domains_only: bool,
+}
+
+impl EnvironmentNetworkPolicy {
+    /// Captures portable traffic restrictions without exposing controller runtime settings.
+    pub fn from_config(config: &NetworkProxyConfig, managed_allowed_domains_only: bool) -> Self {
+        Self {
+            domains: config.domains.clone(),
+            unix_sockets: config.unix_sockets.clone(),
+            allow_upstream_proxy: config.allow_upstream_proxy,
+            dangerously_allow_all_unix_sockets: config.dangerously_allow_all_unix_sockets,
+            allow_local_binding: config.allow_local_binding,
+            managed_allowed_domains_only,
+        }
+    }
+}

codex-rs/network-proxy/src/lib.rs

@@ -6,6 +6,7 @@ mod certs;
 mod config;
 mod connect_policy;
 mod credential_broker;
+mod environment_policy;
 mod http_proxy;
 mod mitm;
 mod mitm_hook;
@@ -41,6 +42,7 @@ pub use config::managed_proxy_ports;
 pub use credential_broker::CREDENTIAL_BROKER_ACTIVE_ENV_KEY;
 pub use credential_broker::brokered_credential_dummy_env_keys;
 pub use credential_broker::brokered_credential_env_keys;
+pub use environment_policy::EnvironmentNetworkPolicy;
 pub use mitm_hook::InjectedHeaderConfig;
 pub use mitm_hook::MitmHookActionsConfig;
 pub use mitm_hook::MitmHookBodyConfig;