## Why
Allow the network policy proxy to run without a full Codex permissions profile.
## What changed
- Add `codex-network-proxy --config <PATH>` to load a standalone JSON file containing a `network` object and run the proxy independently of Codex.
- Require `network.enabled = true`, limit configuration size to 1 MiB, and reject unknown fields, including nested MITM hook fields, and trailing JSON values.
- Enable HTTPS MITM automatically for limited mode or configured `mitm_hooks`, while supporting explicit `mitm` configuration.
- Document the standalone configuration and invocation.
## Testing
Add tests for MITM defaults, dynamic policy keys, unknown fields, and trailing JSON values. Add a regression test that verifies `wait()` promptly returns an error when either the HTTP or SOCKS listener fails.
GitOrigin-RevId: ba20b9c3022b16abaa5597f473c418cfc06c18ee
viyatb-oai
94e3c20906