Always use private desktops for legacy Windows sandboxes (#46554)

## What changed

- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.

## Testing

Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.

GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4

codex-rs/sandboxing/src/spawn.rs

@@ -15,7 +15,7 @@ use crate::WindowsSandboxProxySettingsMode;
 use crate::terminal_queries::respond_to_terminal_queries;
 
 /// Windows-specific inputs for an executor-native process spawn.
-// TODO(anp): Reconcile Windows backend and desktop copies with the supplied sandbox
+// TODO(anp): Reconcile the Windows backend copy with the supplied sandbox
 // context (TurnEnvironment::sandbox_context for turns), preserving this launch snapshot.
 pub struct WindowsSandboxSpawnRequest<'a> {
     pub permission_profile: &'a PermissionProfile,
@@ -25,7 +25,6 @@ pub struct WindowsSandboxSpawnRequest<'a> {
     pub network_proxy_restricting_sid: Option<&'a str>,
     pub proxy_settings_mode: WindowsSandboxProxySettingsMode,
     pub filesystem_overrides: Option<&'a WindowsSandboxFilesystemOverrides>,
-    pub use_private_desktop: bool,
 }
 
 /// Executor-native process launch request shared by local and exec-server execution.
@@ -92,7 +91,6 @@ pub async fn spawn_process(request: SpawnRequest<'_>) -> Result<SpawnedProcess>
                     }),
                     tty: request.tty,
                     stdin_open: request.stdin_open,
-                    use_private_desktop: windows.use_private_desktop,
                 },
             )
             .await