Select the elevated Windows sandbox for network proxies (#33445)

## Why

Windows firewall enforcement is tied to the logon-user sandbox identities. Proxy-enforced commands therefore need the elevated backend even when the configured sandbox mode is the default restricted-token mode.

## What changed

- Select the elevated Windows sandbox backend whenever a command uses the managed network proxy.
- Remove configuration and startup checks that required users or managed requirements to select the elevated sandbox explicitly.
- Start and expose managed network proxy state consistently on Windows.

## Testing

- Verify that proxy enforcement selects the elevated backend for the restricted-token sandbox mode.

GitOrigin-RevId: e01ac052587721c468a8fbcf4e2c7c5a185a3e05

codex-rs/windows-sandbox-rs/src/unified_exec/mod.rs

@@ -10,7 +10,6 @@
 mod backends;
 
 use anyhow::Result;
-use anyhow::bail;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::PermissionProfile;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -48,12 +47,8 @@ pub async fn spawn_windows_sandbox_session_for_level(
     request: WindowsSandboxSessionRequest<'_>,
 ) -> Result<SpawnedProcess> {
     if request.proxy_enforced
-        && !matches!(request.windows_sandbox_level, WindowsSandboxLevel::Elevated)
+        || matches!(request.windows_sandbox_level, WindowsSandboxLevel::Elevated)
     {
-        bail!("network proxy enforcement requires the elevated Windows sandbox backend");
-    }
-
-    if matches!(request.windows_sandbox_level, WindowsSandboxLevel::Elevated) {
         backends::elevated::spawn_windows_sandbox_session_elevated_for_permission_profile(
             request.permission_profile,
             request.workspace_roots,