Honor disabled managed network configuration (#40489)

## Why

Managed network requirements can remain present when `enabled = false`, but a
disabled configuration should not create or expose an active proxy runtime.

## What changed

- Start the managed network proxy only when its effective specification is
  enabled.
- Clear an existing proxy when a permission-profile refresh disables managed
  networking.
- Keep remote executor launches free of managed-network proxy settings when the
  requirements explicitly disable the feature.

## Testing

Added session and unified-exec coverage for initial startup and refresh with
disabled managed networking.

GitOrigin-RevId: f76699802e079eb746d5b1ea6547d19a4bfb7715

codex-rs/core/src/session/mod.rs

@@ -1128,6 +1128,12 @@ impl Session {
                 spec
             }
         };
+        // Disabled specs still carry managed requirements and constraints, but they do not have
+        // listeners and must not be exposed as active managed proxy runtimes.
+        if !spec.enabled() {
+            self.services.network_proxy.store(None);
+            return;
+        }
         if let Some(started_proxy) = self.services.network_proxy.load_full() {
             if let Err(err) = spec.apply_to_started_proxy(started_proxy.as_ref()).await {
                 warn!("failed to refresh managed network proxy for sandbox change: {err}");