Select the elevated Windows sandbox for network proxies (#33445)

## Why

Windows firewall enforcement is tied to the logon-user sandbox identities. Proxy-enforced commands therefore need the elevated backend even when the configured sandbox mode is the default restricted-token mode.

## What changed

- Select the elevated Windows sandbox backend whenever a command uses the managed network proxy.
- Remove configuration and startup checks that required users or managed requirements to select the elevated sandbox explicitly.
- Start and expose managed network proxy state consistently on Windows.

## Testing

- Verify that proxy enforcement selects the elevated backend for the restricted-token sandbox mode.

GitOrigin-RevId: e01ac052587721c468a8fbcf4e2c7c5a185a3e05

codex-rs/core/src/unified_exec/process_manager.rs

@@ -980,15 +980,6 @@ impl UnifiedExecProcessManager {
         mut spawn_lifecycle: SpawnLifecycleHandle,
         environment: &codex_exec_server::Environment,
     ) -> Result<UnifiedExecProcess, UnifiedExecError> {
-        #[cfg(target_os = "windows")]
-        if !environment.is_remote() {
-            crate::config::validate_windows_sandbox_network_proxy_compatibility(
-                request.windows_sandbox_level,
-                request.network.is_some(),
-            )
-            .map_err(|err| UnifiedExecError::create_process(err.to_string()))?;
-        }
-
         let inherited_fds = spawn_lifecycle.inherited_fds();
 
         #[cfg(target_os = "windows")]