Expose system proxy support as an experimental setting (#58157)

## What changed

- Add “System proxy” to `/experimental` for opting into macOS or Windows system proxy settings. Keep `respect_system_proxy` disabled by default.
- Update doctor’s macOS proxy guidance to point to `/experimental` and `codex features enable respect_system_proxy`, and tell users to restart Codex after changing the setting.

## Testing

Add snapshots for the experimental setting and doctor guidance, plus a Responses test verifying that `x-codex-beta-features` includes `respect_system_proxy` only when enabled.

GitOrigin-RevId: caa3e1a7cbe222069f35022b06c59da578b8a4dd

codex-rs/cli/src/doctor/network.rs

@@ -75,6 +75,9 @@ pub(super) async fn checks(
     vec![config_check, network, websocket, reachability]
 }
 
+#[cfg(any(target_os = "macos", test))]
+pub(super) const SYSTEM_PROXY_REMEDIATION: &str = "A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the experimental System proxy setting in `/experimental` or with `codex features enable respect_system_proxy`. Restart Codex after changing this setting.";
+
 pub(super) fn check(config: Option<&Config>) -> DoctorCheck {
     let mut details = Vec::new();
     push_proxy_env_details(&mut details);
@@ -163,10 +166,7 @@ pub(super) fn with_system_proxy_remediation(
             )
         })
     {
-        check.remediation = Some(
-            "A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the under-development feature with `codex features enable respect_system_proxy`."
-                .to_string(),
-        );
+        check.remediation = Some(SYSTEM_PROXY_REMEDIATION.to_string());
     }
     check
 }

codex-rs/cli/src/doctor/output.rs

@@ -1415,6 +1415,15 @@ Background Server
     #[test]
     fn render_human_report_snapshot_covers_environment_rows() {
         let mut report = sample_report();
+        report.checks.push(
+            DoctorCheck::new(
+                "network.reachability",
+                "network",
+                CheckStatus::Fail,
+                "provider is unreachable",
+            )
+            .remediation(super::super::network::SYSTEM_PROXY_REMEDIATION),
+        );
         report.checks.push(
             DoctorCheck::new("config.load", "config", CheckStatus::Ok, "config loaded")
                 .detail("configured TUI mode: fullscreen"),

codex-rs/cli/src/doctor/snapshots/codex__doctor__output__tests__doctor_human_report_environment_rows.snap

@@ -8,6 +8,7 @@ Notes
    ↑ desktop      build 123 available (ready to install)
    ⚠ terminal     narrow terminal
    ✗ auth         token expired - Run `codex login`.
+   ✗ network      provider is unreachable - A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the experimental System proxy setting in `/experimental` or with `codex features enable respect_system_proxy`. Restart Codex after changing this setting.
    ⚠ git          this worktree is not on a Windows Dev Drive - create a trusted Windows Dev Drive: https://learn.microsoft.com/en-us/windows/dev-drive/
    ⚠ security     Microsoft Defender can interfere with Codex. Verify Codex exclusions.
 ─────────────────────────────────────────────────────────────
@@ -65,6 +66,7 @@ Updates
 
 Connectivity
   ✓ network      network environment readable
+  ✗ network      provider is unreachable — A macOS system proxy is configured but unused. If your organization requires it, ask your administrator whether to enable the experimental System proxy setting in `/experimental` or with `codex features enable respect_system_proxy`. Restart Codex after changing this setting.
   ✓ websocket    Responses WebSocket handshake succeeded
   ✓ reachability active provider endpoints are reachable over HTTP
 
@@ -72,7 +74,7 @@ Background Server
   ✓ app-server   background server is not running
 
 ─────────────────────────────────────────────────────────────
-16 ok · 5 notes · 3 warn · 1 fail failed
+16 ok · 6 notes · 3 warn · 2 fail failed
 
 --summary compact output           --all expand truncated lists
 --json redacted report