Load cloud config for sandbox and remote exec-server commands (#57270)

## Why

Sandbox invocations without an explicit permissions profile and remote `exec-server` connections using ChatGPT auth need access to cloud-defined model providers and managed requirements. Cloud bootstrap requests must also respect local application network policy.

## What changed

- Bootstrap sandbox cloud config whenever managed config is included, even without an explicit profile. Skip bootstrap when `--sandbox-state-json` supplies the sandbox state.
- Load cloud config for remote executors beyond workload identity, while skipping forwarders and executors using stdin credentials, AWS SigV4, or agent identity auth. Honor `CODEX_API_KEY` selection so API key connections skip ChatGPT cloud config.
- Apply local application network policy during cloud bootstrap and activate effective application network policy before exec-server clients are created.

## Testing

Add coverage for cloud-defined providers in sandbox and remote exec-server invocations, API key bypass, local policy blocking bundle requests, cloud policy blocking remote registration, and bootstrap exclusions.

GitOrigin-RevId: e8bd6210751e96161f575ade309ebf41bf10f8b5

codex-rs/cli/tests/exec_server/auth_refresh_tests.rs

@@ -27,7 +27,9 @@ async fn noise_executor_refreshes_on_401_and_reloads_rotated_credentials() -> Re
     )?;
     write_chatgpt_auth(
         home.path(),
-        ChatGptAuthFixture::new("old-token").account_id("account"),
+        ChatGptAuthFixture::new("old-token")
+            .account_id("account")
+            .chatgpt_user_id("user"),
         AuthCredentialsStoreMode::File,
     )?;
     Mock::given(path("/refresh"))
@@ -94,7 +96,9 @@ async fn noise_executor_refreshes_on_401_and_reloads_rotated_credentials() -> Re
     // Update storage while the executor is alive, then force a new registration.
     write_chatgpt_auth(
         home.path(),
-        ChatGptAuthFixture::new("rotated-token").account_id("account"),
+        ChatGptAuthFixture::new("rotated-token")
+            .account_id("account")
+            .chatgpt_user_id("user"),
         AuthCredentialsStoreMode::File,
     )?;
     websocket.close(None).await?;