[codex] Reject network proxy with unelevated Windows sandbox

[iceweasel-oai]

Why

On Windows, managed network proxy enforcement requires the elevated sandbox backend. Previously, proxy_enforced silently selected that backend even when the user chose windows.sandbox = "unelevated", which could trigger a UAC prompt that enterprise users without administrator access cannot accept.

Codex should reject that incompatible configuration without silently elevating or preventing a non-strict app-server from starting.

What changed

• Rejects network proxy configuration with the unelevated Windows sandbox during config writes, sandbox setup, and effective permission-profile resolution.
• Keeps non-strict app-server startup recoverable: an existing incompatible config is reported through the normal config warning and defaults fallback.
• Selects the elevated backend only when windows.sandbox = "elevated"; proxy enforcement no longer overrides the configured backend.

Testing

• just test -p codex-core windows_sandbox_level_selects_elevated_backend
• just test -p codex-app-server strict_config
• Added Windows-only coverage for the non-strict startup fallback and config-write rejection.

[viyatb-oai]

Looks good. The follow-up fixes keep config writes from failing on unrelated materialization errors while still rejecting the Windows unelevated sandbox + network proxy combination where it can actually break startup/runtime.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[alexey-openai]

I have read the CLA Document and I hereby sign the CLA

[iceweasel-oai]

Superseded by #31437. The replacement moves the invariant to managed requirements: enabling managed networking now requires administrators to allow only the elevated Windows sandbox. This catches an invalid policy immediately instead of surfacing a hard error when a user later selects the unelevated fallback.