Harden managed proxy setup for sandboxed executions (#34641)

## What changed

- Make the generated Linux proxy socket directory readable inside restricted
  `bubblewrap` sandboxes so the proxy bridge can connect.
- Route `WS_PROXY` and `WSS_PROXY` through the Linux managed proxy bridge.
- Remove inherited proxy attribution tokens from unscoped executions while
  continuing to replace them with the current token for scoped executions.

## Testing

- Exercise `WSS_PROXY` routing with a minimal filesystem policy.
- Cover attribution-token removal and replacement during environment setup.

GitOrigin-RevId: 2f14ddb26baab0147a786bc354d93eb5aad059f3

codex-rs/network-proxy/src/proxy.rs

@@ -902,6 +902,8 @@ impl NetworkProxy {
                 PROXY_ATTRIBUTION_TOKEN_ENV_KEY.to_string(),
                 execution_scope.attribution_token.clone(),
             );
+        } else {
+            env.remove(PROXY_ATTRIBUTION_TOKEN_ENV_KEY);
         }
         let expose_socks_port = self.socks_enabled;
         #[cfg(target_os = "windows")]
@@ -1712,9 +1714,23 @@ mod tests {
 
         let scoped = proxy.for_execution("remote-env", "execution-1", "token-1".to_string())?;
         let launch = scoped.remote_launch_config().await?;
+        let prepared = scoped.prepare_for_optional_environment(
+            HashMap::from([(
+                PROXY_ATTRIBUTION_TOKEN_ENV_KEY.to_string(),
+                "foreign-token".to_string(),
+            )]),
+            /*environment_id*/ None,
+        )?;
 
         assert_eq!(launch.environment_id.as_deref(), Some("remote-env"));
         assert_eq!(launch.execution_id.as_deref(), Some("execution-1"));
+        assert_eq!(
+            prepared
+                .env
+                .get(PROXY_ATTRIBUTION_TOKEN_ENV_KEY)
+                .map(String::as_str),
+            Some("token-1")
+        );
         Ok(())
     }