Handle exec-server network policy requests in the client (#35359)

## What changed

- Add client-side handling for exec-server network policy requests, including request validation, per-process decision routing, and allow, deny, or ask responses.
- Bound concurrent callbacks and fail closed when requests are invalid, exceed capacity, time out, or outlive their process session.
- Replace the callback opt-in flag with a launch-level `policyDecisionTimeoutMs` value and include transport overhead in the executor timeout.
- Preserve callback admission limits across connection recovery and clean up policy state when process startup is abandoned or a session ends.

## Testing

- Cover decision forwarding, invalid and excess requests, cancellation during process cleanup, abandoned starts, timeout propagation, and launch-config serialization.

GitOrigin-RevId: 6ee2a0139e0f8170cf1a5cdd646bd811b7d3c1f6

codex-rs/exec-server/src/network_policy_decisions.rs

@@ -19,14 +19,16 @@ use crate::protocol::NetworkPolicyRequestParams;
 use crate::protocol::NetworkPolicyRequestResponse;
 use crate::rpc_server_requests::RpcServerRequestSender;
 
-// Leave transport overhead outside the client-side 95-second decision window.
-const NETWORK_POLICY_REQUEST_TIMEOUT: Duration = Duration::from_secs(100);
+const NETWORK_POLICY_TRANSPORT_TIMEOUT_MARGIN: Duration = Duration::from_secs(5);
 
 pub(crate) fn network_policy_decider(
     process_id: ProcessId,
     requests: Arc<RwLock<Option<RpcServerRequestSender>>>,
+    controller_timeout: Duration,
     process_shutdown: CancellationToken,
 ) -> Arc<dyn NetworkPolicyDecider> {
+    let request_timeout =
+        controller_timeout.saturating_add(NETWORK_POLICY_TRANSPORT_TIMEOUT_MARGIN);
     Arc::new(move |request: NetworkPolicyRequest| {
         let process_id = process_id.clone();
         let requests = Arc::clone(&requests);
@@ -66,7 +68,7 @@ pub(crate) fn network_policy_decider(
                 response = requests.call_with_timeout::<_, NetworkPolicyRequestResponse>(
                     NETWORK_POLICY_REQUEST_METHOD,
                     &params,
-                    NETWORK_POLICY_REQUEST_TIMEOUT,
+                    request_timeout,
                 ) => response
                     .map(|response| match response.decision {
                         ExecServerNetworkPolicyDecision::Allow => NetworkDecision::Allow,