Add credential brokering to network proxy feature config (#40466)

## What changed

- Add `features.network_proxy.credential_broker` and preserve structured network proxy settings when toggling the feature through config APIs.
- Protect broker enablement and provider context variables from project config, while carrying trusted context into filtered shell environments.
- Propagate brokered credentials through shell snapshots and restore real credentials for unsandboxed escalated commands.
- Normalize broker context environment keys case-insensitively on Windows and avoid conflicting remote managed-network enforcement when no proxy launch configuration is available.

## Testing

- Cover config layering, editing, project sanitization, Windows environment handling, shell snapshots, escalated execution, and end-to-end GitHub credential brokering in the zsh-fork runtime.

GitOrigin-RevId: 500e51e804e1988022052ccfe00b8fac5e495f4f

codex-rs/network-proxy/src/credential_broker.rs

@@ -321,6 +321,11 @@ pub fn brokered_credential_dummy_env_keys(env: &HashMap<String, String>) -> Vec<
     keys
 }
 
+/// Returns environment keys used to bind registered credential providers to their destinations.
+pub fn credential_broker_provider_context_env_keys() -> impl Iterator<Item = &'static str> {
+    providers::credential_providers().flat_map(|provider| provider.context_env_vars.iter().copied())
+}
+
 /// Returns credential keys plus provider context keys already present in an environment with an
 /// active broker.
 pub fn brokered_credential_env_keys(

codex-rs/network-proxy/src/credential_broker/providers.rs

@@ -15,7 +15,7 @@ type TranslateRequestHeader = fn(&HeaderMap, &str, &str) -> Option<HeaderValue>;
 /// Providers must be declared as `static` values because the broker uses their addresses as stable
 /// identities when deduplicating credential records.
 pub(super) struct CredentialProvider {
-    context_env_vars: &'static [&'static str],
+    pub(super) context_env_vars: &'static [&'static str],
     sources: &'static [CredentialSource],
     pub(super) reset_on_configuration_change: bool,
     dummy_value: fn(&str) -> String,

codex-rs/network-proxy/src/lib.rs

@@ -43,6 +43,7 @@ pub use config::managed_proxy_ports;
 pub use credential_broker::CREDENTIAL_BROKER_ACTIVE_ENV_KEY;
 pub use credential_broker::brokered_credential_dummy_env_keys;
 pub use credential_broker::brokered_credential_env_keys;
+pub use credential_broker::credential_broker_provider_context_env_keys;
 pub use environment_policy::EnvironmentNetworkPolicy;
 pub use mitm_hook::InjectedHeaderConfig;
 pub use mitm_hook::MitmHookActionsConfig;