Add experimental Windows sandbox service provisioning (#42353)

## What changed

- Add the default-off `windows_sandbox_service` feature and expose it through
  app-server experimental feature enablement.
- When enabled, attempt service provisioning during elevated Windows sandbox
  setup, using the effective network proxy ports and listener roles. Continue
  through the existing setup path when the service is unavailable or the
  configuration is unsupported.
- Report unsupported Codex home drives as service unavailability so the client
  can fall back to the elevated helper.

## Testing

- Add a Windows-only unit test covering HTTP and SOCKS listener derivation from
  the effective proxy configuration.

GitOrigin-RevId: 40b119cf51f84e5d0e94d6a0a8d5b506d1123526

codex-rs/windows-sandbox-service/src/ipc.rs

@@ -1,5 +1,6 @@
 //! Authenticated local IPC for the Windows sandbox provisioning service.
-//! Configuration parse failures defer provisioning to the client's elevated helper.
+//! Configuration parse failures and unsupported home drives defer provisioning to
+//! the client's elevated helper.
 //! Shutdown wakeups are retried until the listener connects or stops.
 
 mod authentication;
@@ -125,6 +126,9 @@ pub(crate) fn run(shutdown: Arc<AtomicBool>, on_ready: impl FnOnce() -> Result<(
         let result = handle_request(pipe.0, &authorized_process, &sandbox_sid, &shutdown);
         let response = match result {
             Ok(response) => response,
+            Err(error) if error.is::<home::UnsupportedHomeDrive>() => {
+                SandboxProvisioningResponse::Unavailable
+            }
             Err(error) => {
                 eprintln!("sandbox provisioning request failed: {error}");
                 let mut message = String::new();

codex-rs/windows-sandbox-service/src/ipc/home.rs

@@ -21,6 +21,18 @@ use windows_sys::Win32::Storage::FileSystem as filesystem;
 
 const DRIVE_FIXED: u32 = 3;
 
+/// The service does not support this drive; the interactive helper may still work.
+#[derive(Debug)]
+pub(super) struct UnsupportedHomeDrive;
+
+impl std::fmt::Display for UnsupportedHomeDrive {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter.write_str("Codex home must be located on a fixed local drive")
+    }
+}
+
+impl std::error::Error for UnsupportedHomeDrive {}
+
 pub(super) struct OwnedHandle(pub(super) HANDLE);
 
 impl Drop for OwnedHandle {
@@ -41,7 +53,7 @@ pub(super) fn prepare_codex_home(requested: &Path) -> Result<(PathBuf, Vec<Owned
     if unsafe { filesystem::GetDriveTypeW(to_wide(requested_root.as_os_str()).as_ptr()) }
         != DRIVE_FIXED
     {
-        bail!("Codex home must be located on a fixed local drive");
+        return Err(UnsupportedHomeDrive.into());
     }
     let parent = requested
         .parent()
@@ -61,7 +73,7 @@ pub(super) fn prepare_codex_home(requested: &Path) -> Result<(PathBuf, Vec<Owned
         .last()
         .context("find the root of the requested Codex home")?;
     if unsafe { filesystem::GetDriveTypeW(to_wide(root.as_os_str()).as_ptr()) } != DRIVE_FIXED {
-        bail!("Codex home must be located on a fixed local drive");
+        return Err(UnsupportedHomeDrive.into());
     }
     if home != requested {
         pin_existing_ancestors(&home, &mut handles)?;