Always use private desktops for legacy Windows sandboxes (#46554)

## What changed

- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.

## Testing

Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.

GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4

codex-rs/exec-server/src/fs_sandbox.rs

@@ -197,8 +197,6 @@ impl FileSystemSandboxRunner {
                     use_legacy_landlock: sandbox_context.use_legacy_landlock,
                     windows_sandbox_level: windows_sandbox_level
                         .unwrap_or(WindowsSandboxLevel::Disabled),
-                    windows_sandbox_private_desktop: sandbox_context
-                        .windows_sandbox_private_desktop,
                 },
             })
             .map_err(|err| invalid_request(format!("failed to prepare fs sandbox: {err}")))
@@ -885,7 +883,7 @@ mod tests {
             ),
         ]);
         let sandbox_context = crate::FileSystemSandboxContext {
-            windows_sandbox_selection: codex_file_system::WindowsSandboxSelection::Elevated,
+            windows_sandbox_selection: codex_file_system::WindowsSandboxSelection::RestrictedToken,
             ..sandbox_context_with_cwd(&policy, cwd_uri)
         };
         selected.close().expect("remove selected directory");