Select the elevated Windows sandbox for network proxies (#33445)

## Why

Windows firewall enforcement is tied to the logon-user sandbox identities. Proxy-enforced commands therefore need the elevated backend even when the configured sandbox mode is the default restricted-token mode.

## What changed

- Select the elevated Windows sandbox backend whenever a command uses the managed network proxy.
- Remove configuration and startup checks that required users or managed requirements to select the elevated sandbox explicitly.
- Start and expose managed network proxy state consistently on Windows.

## Testing

- Verify that proxy enforcement selects the elevated backend for the restricted-token sandbox mode.

GitOrigin-RevId: e01ac052587721c468a8fbcf4e2c7c5a185a3e05

codex-rs/config/src/config_requirements.rs

@@ -754,16 +754,6 @@ impl WindowsRequirementsToml {
     pub fn is_empty(&self) -> bool {
         self.allowed_sandbox_implementations.is_none()
     }
-
-    pub fn allows_only_elevated_sandbox(&self) -> bool {
-        let Some(modes) = self.allowed_sandbox_implementations.as_deref() else {
-            return false;
-        };
-        !modes.is_empty()
-            && modes
-                .iter()
-                .all(|&mode| mode == WindowsSandboxModeToml::Elevated)
-    }
 }
 
 #[derive(Deserialize, Debug, Clone, Default, PartialEq, Eq)]
@@ -891,14 +881,6 @@ pub struct ConfigRequirementsToml {
     pub guardian_policy_config: Option<String>,
 }
 
-impl ConfigRequirementsToml {
-    pub fn allows_only_elevated_windows_sandbox(&self) -> bool {
-        self.windows
-            .as_ref()
-            .is_some_and(WindowsRequirementsToml::allows_only_elevated_sandbox)
-    }
-}
-
 #[derive(Deserialize, Debug, Clone, Default, PartialEq, Eq)]
 pub struct ModelsRequirementsToml {
     pub new_thread: Option<NewThreadModelDefaultsToml>,

codex-rs/config/src/constraint.rs

@@ -33,16 +33,6 @@ pub enum ConstraintError {
         requirement_source: RequirementSource,
         reason: String,
     },
-
-    #[error(
-        "network proxy configuration requires `[windows] allowed_sandbox_implementations = [\"elevated\"]` in requirements"
-    )]
-    NetworkProxyRequiresElevatedWindowsSandboxRequirement,
-
-    #[error(
-        "the network proxy is incompatible with the unelevated Windows sandbox; set `windows.sandbox = \"elevated\"` or disable the network proxy"
-    )]
-    NetworkProxyIncompatibleWithUnelevatedWindowsSandbox,
 }
 
 impl ConstraintError {
@@ -51,14 +41,6 @@ impl ConstraintError {
             field_name: field_name.into(),
         }
     }
-
-    pub fn is_windows_network_configuration_error(&self) -> bool {
-        matches!(
-            self,
-            Self::NetworkProxyRequiresElevatedWindowsSandboxRequirement
-                | Self::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox
-        )
-    }
 }
 
 pub type ConstraintResult<T> = Result<T, ConstraintError>;