Require the elevated Windows sandbox for network proxies (#32857)

## Why

Network proxy enforcement on Windows requires the elevated sandbox backend. Silently selecting that backend for an unelevated configuration makes the effective sandbox differ from the configured mode.

## What changed

- Reject enabled network proxy configurations on Windows unless managed requirements allow only the elevated sandbox and `windows.sandbox` resolves to `"elevated"`.
- Preserve the configured sandbox backend during execution and validate proxy compatibility at config loading, sandbox setup, and process launch boundaries.
- Defer this validation during cloud-config bootstrap so authoritative managed requirements can be loaded first.
- Do not start or expose disabled Windows proxies, and render transitions to disabled networking as `<network enabled="false"></network>`.

## Testing

- Cover Windows requirement and sandbox compatibility matrices, bootstrap behavior, backend selection, disabled proxy handling, and environment-context updates.

GitOrigin-RevId: bfa1dda98594e0db61883f8e7f65bd560e3453e6

codex-rs/app-server/src/request_processors/command_exec_processor.rs

@@ -204,6 +204,7 @@ impl CommandExecRequestProcessor {
             network_proxy_permission_profile,
             managed_network_requirements_enabled,
             windows_sandbox_workspace_roots,
+            windows_sandbox_level,
         ) = if let Some(permission_profile) = permission_profile {
             let overrides = ConfigOverrides {
                 cwd: Some(cwd.to_path_buf()),
@@ -232,6 +233,7 @@ impl CommandExecRequestProcessor {
                 config.permissions.permission_profile().clone(),
                 config.managed_network_requirements_enabled(),
                 config.effective_workspace_roots(),
+                WindowsSandboxLevel::from_config(&config),
             )
         } else if let Some(policy) = sandbox_policy.map(|policy| policy.to_core()) {
             self.config
@@ -258,6 +260,7 @@ impl CommandExecRequestProcessor {
                 self.config.permissions.permission_profile().clone(),
                 self.config.managed_network_requirements_enabled(),
                 self.config.effective_workspace_roots(),
+                windows_sandbox_level,
             )
         } else {
             (
@@ -266,9 +269,13 @@ impl CommandExecRequestProcessor {
                 self.config.permissions.permission_profile().clone(),
                 self.config.managed_network_requirements_enabled(),
                 self.config.effective_workspace_roots(),
+                windows_sandbox_level,
             )
         };
-        let started_network_proxy = match network_proxy_spec.as_ref() {
+        let started_network_proxy = match network_proxy_spec
+            .as_ref()
+            .filter(|spec| !cfg!(target_os = "windows") || spec.enabled())
+        {
             Some(spec) => match spec
                 .start_proxy(
                     &network_proxy_permission_profile,

codex-rs/app-server/src/request_processors/windows_sandbox_processor.rs

@@ -63,6 +63,19 @@ impl WindowsSandboxRequestProcessor {
             config.config_layer_stack.requirements(),
             params.mode,
         )?;
+        let target_windows_sandbox_level = match setup_mode {
+            CoreWindowsSandboxSetupMode::Elevated => WindowsSandboxLevel::Elevated,
+            CoreWindowsSandboxSetupMode::Unelevated => WindowsSandboxLevel::RestrictedToken,
+        };
+        codex_core::config::validate_windows_sandbox_network_proxy_compatibility(
+            target_windows_sandbox_level,
+            config
+                .permissions
+                .network
+                .as_ref()
+                .is_some_and(codex_core::config::NetworkProxySpec::enabled),
+        )
+        .map_err(|err| invalid_request(err.to_string()))?;
 
         self.outgoing
             .send_response(