Centralize managed network proxy startup (#61337)

## What changed

Add `NetworkProxy::start_managed` and use it in core and exec-server to share proxy construction, startup, and error context. Keep approval-policy selection in core and pass the active decider and blocked-request observer to the shared helper.

## Testing

Expand session coverage for a full-access to workspace-write profile change: verify decider calls with approvals enabled, approvals disabled, and a final managed allowlist, and verify blocked-request notifications in each case.

GitOrigin-RevId: 97abdaa9af698166f46d74e0f231ec557d346200

codex-rs/exec-server/src/process_sandbox.rs

@@ -366,20 +366,14 @@ async fn prepare_managed_network(
                 registration_id: registration.executor_registration_id.clone(),
             }),
     });
-    let mut builder = NetworkProxy::builder()
-        .state(Arc::new(state))
-        .managed_proxy_routing(routing);
-    if let Some(network_policy_decider) = network_policy_decider {
-        builder = builder.policy_decider_arc(network_policy_decider);
-    }
-    let proxy = builder
-        .build()
-        .await
-        .map_err(|err| internal_error(format!("failed to build executor network proxy: {err}")))?;
-    let handle = proxy
-        .run()
-        .await
-        .map_err(|err| internal_error(format!("failed to start executor network proxy: {err}")))?;
+    let (proxy, handle) = NetworkProxy::start_managed(
+        state,
+        routing,
+        network_policy_decider,
+        /*blocked_request_observer*/ None,
+    )
+    .await
+    .map_err(|err| internal_error(err.to_string()))?;
     #[cfg(target_os = "windows")]
     let network_proxy_restricting_sid = if routing == ManagedProxyRouting::SharedIngress {
         Some(