Add network policy metadata to environment configuration (#39055)

## What changed

- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
  Unix-socket, upstream-proxy, and local-binding restrictions without exposing
  controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
  the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
  readiness until runtime enforcement is implemented, while preserving the
  existing controller policy when the field is absent.

## Testing

- Cover rejection through both environment preview and readiness, including
  preservation of the existing environment selection.

GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80

codex-rs/core/src/session/environment.rs

@@ -34,6 +34,13 @@ fn validate_environment_config(
     selection: &TurnEnvironmentSelection,
     config: &EnvironmentConfig,
 ) -> CodexResult<()> {
+    // The public type can be used by owners before runtime enforcement lands. Do not
+    // accept restrictions here until the managed proxy can actually enforce them.
+    if config.network_policy.is_some() {
+        return Err(CodexErr::InvalidRequest(
+            "attachment-owned network policy is not supported yet".to_string(),
+        ));
+    }
     if config.selected_capability_roots.len() > MAX_SELECTED_CAPABILITY_ROOTS {
         return Err(CodexErr::InvalidRequest(format!(
             "environment readiness contains more than {MAX_SELECTED_CAPABILITY_ROOTS} selected capability roots"