## Why
Destination restrictions and policy revocation must remain effective during redirects, response body reads, and established WebSocket traffic. Policy denials must also survive error handling so callers do not retry them or report a revoked operation as successful.
## What changed
- Route managed HTTP clients through a shared `RequestBuilder` and policy-aware execution, checking each redirect destination before route resolution and retaining a network permit while consuming response bodies.
- Guard WebSocket connection setup, reads, and writes with revocable permits, including independent wakeups for split readers and writers.
- Preserve `TransportError::Policy` through HTTP, SSE, and realtime error handling, and treat policy denials as non-retryable.
- Keep the supplied network policy in plugin startup HTTP requests and propagate response body failures from backend and plugin requests.
## Testing
Add regression coverage for rejection before connecting, revocation during redirect routing and streamed body reads, split WebSocket revocation, realtime writer error propagation, and revoked plugin upload responses.
GitOrigin-RevId: fba36700444c98a8364c09b4dc5452c4d78a90fb
## Why
Standalone web search selected a proxy route only for the initial endpoint. Redirect destinations can require a different system proxy route.
## What changed
- Add `RouteAwareClientPool` support to `ReqwestTransport` for both buffered and streaming requests, and use it for standalone web search.
- Preserve default Codex headers and Cloudflare cookie handling across routes, while retaining the default client behavior when route-aware handling is disabled or Codex is sandboxed.
- Share request construction so URL authentication and header precedence follow `reqwest` semantics, applying them once before redirects and TLS retries.
- Map route-aware failures to transport errors and remove request URLs from those errors.
## Testing
Add regression coverage for redirects through distinct proxies, preservation of POST bodies and default headers, URL authentication and header precedence, and transport error classification without URL leakage.
GitOrigin-RevId: 19a10a62118846db09dd95265dc277e54aac09ef
## What changed
Move request sending, redirect handling, and rustls fallback from `route_aware_client_pool.rs` into `route_aware_client_pool/execution.rs`, preserving existing behavior. Give the moved methods parent-module visibility and import `MAX_REDIRECTS` explicitly in the existing tests.
GitOrigin-RevId: 41be33a9250f09f562fb18a77fdb8fd9398cb49a
acrognale-oai