Centralize managed network proxy startup (#61337)

## What changed

Add `NetworkProxy::start_managed` and use it in core and exec-server to share proxy construction, startup, and error context. Keep approval-policy selection in core and pass the active decider and blocked-request observer to the shared helper.

## Testing

Expand session coverage for a full-access to workspace-write profile change: verify decider calls with approvals enabled, approvals disabled, and a final managed allowlist, and verify blocked-request notifications in each case.

GitOrigin-RevId: 97abdaa9af698166f46d74e0f231ec557d346200

codex-rs/network-proxy/src/proxy.rs

@@ -886,6 +886,33 @@ impl NetworkProxy {
         NetworkProxyBuilder::default()
     }
 
+    /// Starts a Codex-managed proxy from resolved policy. Keep the handle for as long as
+    /// clients need the proxy. A disabled policy returns the proxy and an inactive handle.
+    pub async fn start_managed(
+        state: NetworkProxyState,
+        routing: ManagedProxyRouting,
+        policy_decider: Option<Arc<dyn NetworkPolicyDecider>>,
+        blocked_request_observer: Option<Arc<dyn BlockedRequestObserver>>,
+    ) -> Result<(Self, NetworkProxyHandle)> {
+        // Startup errors can cross the executor RPC boundary. Keep the stage and immediate cause.
+        let proxy = NetworkProxyBuilder {
+            state: Some(Arc::new(state)),
+            managed_by_codex: true,
+            managed_proxy_routing: routing,
+            policy_decider,
+            blocked_request_observer,
+            ..Default::default()
+        }
+        .build()
+        .await
+        .map_err(|err| anyhow::anyhow!("failed to build network proxy: {err}"))?;
+        let handle = proxy
+            .run()
+            .await
+            .map_err(|err| anyhow::anyhow!("failed to run network proxy: {err}"))?;
+        Ok((proxy, handle))
+    }
+
     pub fn http_addr(&self) -> SocketAddr {
         self.http_addr
     }