Always use private desktops for legacy Windows sandboxes (#46554)

## What changed

- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.

## Testing

Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.

GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4

codex-rs/exec-server/tests/file_system_windows.rs

@@ -569,8 +569,7 @@ async fn file_system_private_desktop_survives_helper_exits_and_separates_permiss
     let path = tmp.path().join("contents.txt");
     std::fs::write(&path, b"initial")?;
     let uri = PathUri::from_host_native_path(&path)?;
-    let mut sandbox = workspace_write_sandbox(tmp.path().to_path_buf());
-    sandbox.windows_sandbox_private_desktop = true;
+    let sandbox = workspace_write_sandbox(tmp.path().to_path_buf());
     let before = process_private_desktops()?;
     let write = file_system
         .write_file(
@@ -624,7 +623,6 @@ async fn file_system_private_desktop_survives_helper_exits_and_separates_permiss
 
     let mut readonly = read_only_sandbox_for_cwd(tmp.path().to_path_buf())?;
     readonly.windows_sandbox_selection = WindowsSandboxSelection::RestrictedToken;
-    readonly.windows_sandbox_private_desktop = true;
     file_system
         .write_file(
             &uri,