Require the elevated Windows sandbox for network proxies (#32857)

## Why

Network proxy enforcement on Windows requires the elevated sandbox backend. Silently selecting that backend for an unelevated configuration makes the effective sandbox differ from the configured mode.

## What changed

- Reject enabled network proxy configurations on Windows unless managed requirements allow only the elevated sandbox and `windows.sandbox` resolves to `"elevated"`.
- Preserve the configured sandbox backend during execution and validate proxy compatibility at config loading, sandbox setup, and process launch boundaries.
- Defer this validation during cloud-config bootstrap so authoritative managed requirements can be loaded first.
- Do not start or expose disabled Windows proxies, and render transitions to disabled networking as `<network enabled="false"></network>`.

## Testing

- Cover Windows requirement and sandbox compatibility matrices, bootstrap behavior, backend selection, disabled proxy handling, and environment-context updates.

GitOrigin-RevId: bfa1dda98594e0db61883f8e7f65bd560e3453e6

codex-rs/config/src/config_requirements.rs

@@ -754,6 +754,16 @@ impl WindowsRequirementsToml {
     pub fn is_empty(&self) -> bool {
         self.allowed_sandbox_implementations.is_none()
     }
+
+    pub fn allows_only_elevated_sandbox(&self) -> bool {
+        let Some(modes) = self.allowed_sandbox_implementations.as_deref() else {
+            return false;
+        };
+        !modes.is_empty()
+            && modes
+                .iter()
+                .all(|&mode| mode == WindowsSandboxModeToml::Elevated)
+    }
 }
 
 #[derive(Deserialize, Debug, Clone, Default, PartialEq, Eq)]
@@ -881,6 +891,14 @@ pub struct ConfigRequirementsToml {
     pub guardian_policy_config: Option<String>,
 }
 
+impl ConfigRequirementsToml {
+    pub fn allows_only_elevated_windows_sandbox(&self) -> bool {
+        self.windows
+            .as_ref()
+            .is_some_and(WindowsRequirementsToml::allows_only_elevated_sandbox)
+    }
+}
+
 #[derive(Deserialize, Debug, Clone, Default, PartialEq, Eq)]
 pub struct ModelsRequirementsToml {
     pub new_thread: Option<NewThreadModelDefaultsToml>,

codex-rs/config/src/constraint.rs

@@ -33,6 +33,16 @@ pub enum ConstraintError {
         requirement_source: RequirementSource,
         reason: String,
     },
+
+    #[error(
+        "network proxy configuration requires `[windows] allowed_sandbox_implementations = [\"elevated\"]` in requirements"
+    )]
+    NetworkProxyRequiresElevatedWindowsSandboxRequirement,
+
+    #[error(
+        "the network proxy is incompatible with the unelevated Windows sandbox; set `windows.sandbox = \"elevated\"` or disable the network proxy"
+    )]
+    NetworkProxyIncompatibleWithUnelevatedWindowsSandbox,
 }
 
 impl ConstraintError {
@@ -41,6 +51,14 @@ impl ConstraintError {
             field_name: field_name.into(),
         }
     }
+
+    pub fn is_windows_network_configuration_error(&self) -> bool {
+        matches!(
+            self,
+            Self::NetworkProxyRequiresElevatedWindowsSandboxRequirement
+                | Self::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox
+        )
+    }
 }
 
 pub type ConstraintResult<T> = Result<T, ConstraintError>;