Honor disabled managed network configuration (#40489)

## Why

Managed network requirements can remain present when `enabled = false`, but a
disabled configuration should not create or expose an active proxy runtime.

## What changed

- Start the managed network proxy only when its effective specification is
  enabled.
- Clear an existing proxy when a permission-profile refresh disables managed
  networking.
- Keep remote executor launches free of managed-network proxy settings when the
  requirements explicitly disable the feature.

## Testing

Added session and unified-exec coverage for initial startup and refresh with
disabled managed networking.

GitOrigin-RevId: f76699802e079eb746d5b1ea6547d19a4bfb7715

codex-rs/core/src/session/session.rs

@@ -1274,7 +1274,12 @@ impl Session {
                         )
                     });
             let (network_proxy, session_network_proxy) =
-                if let Some(spec) = config.permissions.network.as_ref() {
+                if let Some(spec) = config
+                    .permissions
+                    .network
+                    .as_ref()
+                    .filter(|spec| spec.enabled())
+                {
                     let current_exec_policy = exec_policy.current();
                     let (network_proxy, session_network_proxy) = Self::start_managed_network_proxy(
                         spec,