fix: cancel Windows sandbox on network denial (#19880)

## Why

When Guardian or the sandbox network proxy detects and denies a network
attempt, core cancels the associated execution through `ExecExpiration`.
The Windows sandbox capture path was only forwarding the timeout
component of that expiration state. As a result, a sandboxed Windows
command whose network attempt had already been denied could keep running
until its timeout elapsed rather than terminating promptly in response
to the denial.

This change closes that cancellation-propagation gap for Windows sandbox
execution.

## What changed

- Added `WindowsSandboxCancellationToken` as the cancellation hook
exposed to Windows capture backends.
- Extracted the cancellation token from `ExecExpiration` in core and
passed it to both the direct and elevated Windows sandbox capture paths
alongside the existing timeout.
- Updated direct capture to poll for either process exit, timeout, or
cancellation and to terminate cancelled processes without reporting them
as timed out.
- Updated elevated capture to watch for cancellation and send the
existing `Terminate` IPC frame to the elevated runner. The watcher parks
for 50 ms between checks to bound response latency without a tight busy
wait.
- Added Windows regression coverage for a long-running PowerShell
command: cancellation ends capture before its timeout and does not set
`timed_out`.
- Added a visible skip diagnostic when that PowerShell-dependent
regression test cannot execute, and consolidated the duplicated
expiration-policy branch identified in review.

## Security

This improves enforcement after a denied network attempt has been
attributed to a Windows sandboxed execution: the command no longer
remains alive simply because Windows capture lost the cancellation
signal.

This PR does not claim to make Windows offline mode an airtight
no-network or no-exfiltration boundary. It does not introduce
AppContainer or change how network denial is detected; it makes an
already-detected denial promptly stop the affected sandboxed command.

## Validation

### Commands run

- `just fmt`
- `cargo test -p codex-windows-sandbox`
- `cargo test -p codex-core network_denial`
- `cargo clippy -p codex-core -p codex-windows-sandbox --tests --no-deps
-- -D warnings`
- `just argument-comment-lint -p codex-windows-sandbox -p codex-core`

The new capture regression is `cfg(target_os = "windows")`, so Windows
CI is the execution coverage for that test path. The local macOS test
runs validate the host-runnable crate and core network-denial behavior.

---------

Co-authored-by: Codex <noreply@openai.com>

codex-rs/windows-sandbox-rs/src/unified_exec/tests.rs

@@ -1,6 +1,7 @@
 #![cfg(target_os = "windows")]
 
 use super::spawn_windows_sandbox_session_legacy;
+use crate::WindowsSandboxCancellationToken;
 use crate::ipc_framed::Message;
 use crate::ipc_framed::decode_bytes;
 use crate::ipc_framed::read_frame;
@@ -16,8 +17,10 @@ use std::io::Seek;
 use std::io::SeekFrom;
 use std::path::Path;
 use std::path::PathBuf;
+use std::sync::Arc;
 use std::sync::Mutex;
 use std::sync::MutexGuard;
+use std::sync::atomic::AtomicBool;
 use std::sync::atomic::AtomicU64;
 use std::sync::atomic::Ordering;
 use std::time::Duration;
@@ -431,6 +434,7 @@ fn legacy_capture_powershell_emits_output() {
         cwd.as_path(),
         HashMap::new(),
         Some(10_000),
+        /*cancellation*/ None,
         /*use_private_desktop*/ true,
     )
     .expect("run legacy capture powershell");
@@ -446,6 +450,57 @@ fn legacy_capture_powershell_emits_output() {
     );
 }
 
+#[test]
+fn legacy_capture_cancellation_is_not_reported_as_timeout() {
+    let Some(pwsh) = pwsh_path() else {
+        eprintln!("skipping cancellation regression test: PowerShell 7 is not installed");
+        return;
+    };
+    let _guard = legacy_process_test_guard();
+    let cwd = sandbox_cwd();
+    let codex_home = sandbox_home("legacy-capture-cancel");
+    let permission_profile = PermissionProfile::workspace_write();
+    let cancelled = Arc::new(AtomicBool::new(false));
+    let cancelled_for_token = Arc::clone(&cancelled);
+    let cancellation =
+        WindowsSandboxCancellationToken::new(move || cancelled_for_token.load(Ordering::SeqCst));
+    let cancelled_for_thread = Arc::clone(&cancelled);
+    let cancel_thread = std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_millis(200));
+        cancelled_for_thread.store(true, Ordering::SeqCst);
+    });
+
+    let started_at = Instant::now();
+    let result = run_windows_sandbox_capture(
+        &permission_profile,
+        cwd.as_path(),
+        codex_home.path(),
+        vec![
+            pwsh.display().to_string(),
+            "-NoProfile".to_string(),
+            "-Command".to_string(),
+            "Start-Sleep -Seconds 30".to_string(),
+        ],
+        cwd.as_path(),
+        HashMap::new(),
+        Some(30_000),
+        /*cancellation*/ Some(cancellation),
+        /*use_private_desktop*/ true,
+    )
+    .expect("run legacy capture powershell with cancellation");
+    cancel_thread.join().expect("cancel thread should finish");
+
+    assert!(
+        started_at.elapsed() < Duration::from_secs(10),
+        "cancellation should end capture before the timeout"
+    );
+    assert!(
+        !result.timed_out,
+        "cancellation should not be reported as a timeout"
+    );
+    assert_ne!(result.exit_code, 0);
+}
+
 #[test]
 fn legacy_tty_powershell_emits_output_and_accepts_input() {
     let Some(pwsh) = pwsh_path() else {