Skip the network denial grace period when remote decisions drain (#59960)

## Why

Completed remote commands wait up to 100 ms for late network denials even when all execution-owned network decision callbacks and requests have finished.

## What changed

Allow deferred network approval cleanup to finish as soon as an executor-owned remote proxy's decisions drain. Retain the grace period when a shared listener could still report an untagged denial, including when that listener starts during the command. Always register the blocked-request observer when starting the session proxy.

## Testing

Extend the paused-time regression test to cover immediate completion after remote callbacks drain and propagation of a late denial from a newly registered shared listener.

GitOrigin-RevId: 41bda6504f6d97d5626beba58cf30fb4a9a2dbdd

codex-rs/network-proxy/src/proxy/execution_scope.rs

@@ -17,6 +17,17 @@ impl Drop for ExecutionScope {
 }
 
 impl NetworkProxy {
+    /// Waits until every remote decision callback and in-flight request for this
+    /// execution has been dropped. Call after the executor has started, when no
+    /// further callbacks will be installed for this scope. An unscoped proxy
+    /// cannot establish this boundary, so its wait remains pending.
+    pub async fn wait_for_remote_policy_deciders(&self) {
+        match &self.execution_scope {
+            Some(scope) => scope.lifetime_tx.closed().await,
+            None => std::future::pending().await,
+        }
+    }
+
     /// Returns a proxy with execution-specific attribution and attachment policy.
     pub fn for_execution(
         &self,