Add experimental Windows sandbox service provisioning (#42353)

## What changed

- Add the default-off `windows_sandbox_service` feature and expose it through
  app-server experimental feature enablement.
- When enabled, attempt service provisioning during elevated Windows sandbox
  setup, using the effective network proxy ports and listener roles. Continue
  through the existing setup path when the service is unavailable or the
  configuration is unsupported.
- Report unsupported Codex home drives as service unavailability so the client
  can fall back to the elevated helper.

## Testing

- Add a Windows-only unit test covering HTTP and SOCKS listener derivation from
  the effective proxy configuration.

GitOrigin-RevId: 40b119cf51f84e5d0e94d6a0a8d5b506d1123526

codex-rs/core/src/config/network_proxy_spec.rs

@@ -98,6 +98,46 @@ impl NetworkProxySpec {
         self.config.allow_local_binding
     }
 
+    /// Returns the firewall settings and listener identities used by the Windows provisioning service.
+    #[cfg(target_os = "windows")]
+    pub fn windows_sandbox_proxy_listeners(
+        &self,
+    ) -> std::io::Result<(
+        codex_windows_sandbox::WindowsSandboxProvisioningSettings,
+        codex_windows_sandbox::WindowsSandboxProxyListeners,
+    )> {
+        if !self.config.enabled {
+            return Ok((
+                codex_windows_sandbox::WindowsSandboxProvisioningSettings::default(),
+                codex_windows_sandbox::WindowsSandboxProxyListeners::default(),
+            ));
+        }
+
+        let proxy_ports = self.configured_proxy_ports()?;
+        let http_port = self
+            .proxy_host_and_port()
+            .rsplit_once(':')
+            .and_then(|(_, port)| port.parse::<u16>().ok())
+            .ok_or_else(|| std::io::Error::other("invalid HTTP proxy listener port"))?;
+        let socks_port = self.config.enable_socks5.then(|| {
+            proxy_ports
+                .iter()
+                .copied()
+                .find(|port| *port != http_port)
+                .unwrap_or(http_port)
+        });
+        Ok((
+            codex_windows_sandbox::WindowsSandboxProvisioningSettings {
+                proxy_ports,
+                allow_local_binding: self.config.allow_local_binding,
+            },
+            codex_windows_sandbox::WindowsSandboxProxyListeners {
+                http_ports: vec![http_port],
+                socks_ports: socks_port.into_iter().collect(),
+            },
+        ))
+    }
+
     pub fn from_config_and_constraints(
         config: NetworkProxyConfig,
         requirements: Option<NetworkConstraints>,

codex-rs/core/src/config/network_proxy_spec_tests.rs

@@ -44,6 +44,38 @@ fn build_state_with_audit_metadata_threads_metadata_to_state() {
     assert_eq!(state.audit_metadata(), &metadata);
 }
 
+#[cfg(target_os = "windows")]
+#[test]
+fn windows_sandbox_proxy_listeners_preserve_effective_protocol_roles() {
+    let spec = NetworkProxySpec::from_config_and_constraints(
+        NetworkProxyConfig {
+            enabled: true,
+            proxy_url: "http://127.0.0.1:48081".to_string(),
+            socks_url: "socks5h://127.0.0.1:3128".to_string(),
+            allow_local_binding: true,
+            ..NetworkProxyConfig::default()
+        },
+        /*requirements*/ None,
+        &PermissionProfile::workspace_write(),
+    )
+    .expect("effective network configuration should be valid");
+
+    assert_eq!(
+        spec.windows_sandbox_proxy_listeners()
+            .expect("effective proxy listeners should resolve"),
+        (
+            codex_windows_sandbox::WindowsSandboxProvisioningSettings {
+                proxy_ports: vec![3128, 48081],
+                allow_local_binding: true,
+            },
+            codex_windows_sandbox::WindowsSandboxProxyListeners {
+                http_ports: vec![48081],
+                socks_ports: vec![3128],
+            },
+        )
+    );
+}
+
 #[test]
 fn environment_policy_replaces_soft_controller_allowlist_and_preserves_denials() {
     let requirements = NetworkConstraints {