Record Windows sandbox private desktop usage (#42596)

## What changed

Increment the `codex.windows_sandbox.private_desktop` counter when preparing a
Windows restricted-token sandbox execution, tagging it with whether private
desktop isolation is enabled.

GitOrigin-RevId: 1eb5e183b57e19753dc133dbe152eabe23dd2a23

codex-rs/sandboxing/src/manager.rs

@@ -451,11 +451,22 @@ impl SandboxManager {
                             .to_string(),
                     ));
                 }
-                (
-                    os_argv_to_strings(argv),
-                    None,
-                    Some(pending_sandboxed_request?),
-                )
+                let pending = pending_sandboxed_request?;
+                if let Some(metrics) = codex_otel::global() {
+                    let _ = metrics.counter(
+                        "codex.windows_sandbox.private_desktop",
+                        /*inc*/ 1,
+                        &[(
+                            "enabled",
+                            if windows_sandbox_private_desktop {
+                                "true"
+                            } else {
+                                "false"
+                            },
+                        )],
+                    );
+                }
+                (os_argv_to_strings(argv), None, Some(pending))
             }
             #[cfg(not(target_os = "windows"))]
             SandboxType::WindowsRestrictedToken => (