Route executor policy audits through log-only telemetry (#38800)

## Why

Forwarded network policy decisions are audit telemetry and should not be
written to the persistent state log.

## What changed

- Emit forwarded `codex.network_proxy.policy_decision` events on the
  `codex_otel.log_only` target, keeping them available to OTEL log export while
  excluding them from persistent logs.
- Assert the log-only target in the existing trusted-metadata audit test.

GitOrigin-RevId: 16d07c8f390245036e4fa092a876012ef2b2fdba

codex-rs/exec-server/src/client/network_policy_audit.rs

@@ -52,7 +52,7 @@ pub(super) fn emit_network_policy_decision(
     };
     let metadata = &context.metadata;
     tracing::event!(
-        target: "codex_otel.network_proxy",
+        target: "codex_otel.log_only",
         tracing::Level::INFO,
         event.name = "codex.network_proxy.policy_decision",
         event.timestamp = decision.timestamp,

codex-rs/exec-server/src/client/tests/network_policy_tests.rs

@@ -177,6 +177,7 @@ async fn policy_decisions_reject_forged_process_and_use_trusted_controller_metad
         .expect("audit log should be UTF-8");
         assert!(!output.contains("forged.example"));
         for expected in [
+            "codex_otel.log_only",
             "trusted-conversation",
             "trusted-account",
             "trusted-execution",