Require the elevated Windows sandbox for network proxies (#32857)

## Why

Network proxy enforcement on Windows requires the elevated sandbox backend. Silently selecting that backend for an unelevated configuration makes the effective sandbox differ from the configured mode.

## What changed

- Reject enabled network proxy configurations on Windows unless managed requirements allow only the elevated sandbox and `windows.sandbox` resolves to `"elevated"`.
- Preserve the configured sandbox backend during execution and validate proxy compatibility at config loading, sandbox setup, and process launch boundaries.
- Defer this validation during cloud-config bootstrap so authoritative managed requirements can be loaded first.
- Do not start or expose disabled Windows proxies, and render transitions to disabled networking as `<network enabled="false"></network>`.

## Testing

- Cover Windows requirement and sandbox compatibility matrices, bootstrap behavior, backend selection, disabled proxy handling, and environment-context updates.

GitOrigin-RevId: bfa1dda98594e0db61883f8e7f65bd560e3453e6

codex-rs/core/src/context/environment_context.rs

@@ -212,22 +212,26 @@ pub(crate) fn push_xml_escaped_text(rendered: &mut String, value: &str) {
 
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub(crate) struct NetworkContext {
+    enabled: bool,
     allowed_domains: Vec<String>,
     denied_domains: Vec<String>,
 }
 
 impl NetworkContext {
-    pub(crate) fn new(allowed_domains: Vec<String>, denied_domains: Vec<String>) -> Self {
+    pub(crate) fn new(enabled: bool, allowed: Vec<String>, denied: Vec<String>) -> Self {
         Self {
-            allowed_domains,
-            denied_domains,
+            enabled,
+            allowed_domains: allowed,
+            denied_domains: denied,
         }
     }
 
     pub(super) fn render(&self) -> String {
-        let mut rendered = "<network enabled=\"true\">".to_string();
-        Self::push_rendered_domain_element(&mut rendered, "allowed", &self.allowed_domains);
-        Self::push_rendered_domain_element(&mut rendered, "denied", &self.denied_domains);
+        let mut rendered = format!("<network enabled=\"{}\">", self.enabled);
+        if self.enabled {
+            Self::push_rendered_domain_element(&mut rendered, "allowed", &self.allowed_domains);
+            Self::push_rendered_domain_element(&mut rendered, "denied", &self.denied_domains);
+        }
         rendered.push_str("</network>");
         rendered
     }

codex-rs/core/src/context/world_state/environment.rs

@@ -369,6 +369,7 @@ fn network_from_turn_context(turn_context: &TurnContext) -> Option<NetworkContex
         .as_ref()?;
 
     Some(NetworkContext::new(
+        turn_context.network.is_some(),
         network
             .domains
             .as_ref()

codex-rs/core/src/context/world_state/environment_render_tests.rs

@@ -110,6 +110,7 @@ fn serialize_environment_context_with_foreign_windows_cwd() {
 #[test]
 fn serialize_environment_context_with_network() {
     let network = NetworkContext::new(
+        /*enabled*/ true,
         vec!["api.example.com".to_string(), "*.openai.com".to_string()],
         vec!["blocked.example.com".to_string()],
     );

codex-rs/core/src/context/world_state/environment_tests.rs

@@ -117,6 +117,7 @@ fn persisted_turn_context_values_render_a_diff() -> Result<()> {
         current_date: Some("2026-06-19".to_string()),
         timezone: Some("UTC".to_string()),
         network: Some(NetworkContext::new(
+            /*enabled*/ true,
             vec!["old.example.com".to_string()],
             vec![],
         )),
@@ -131,6 +132,7 @@ fn persisted_turn_context_values_render_a_diff() -> Result<()> {
         current_date: Some("2026-06-20".to_string()),
         timezone: Some("America/Los_Angeles".to_string()),
         network: Some(NetworkContext::new(
+            /*enabled*/ true,
             vec!["new.example.com".to_string()],
             vec!["blocked.example.com".to_string()],
         )),