Honor system proxy settings in the daemon updater (#34495)

## Why

The PID-managed daemon updater downloaded the standalone installer directly,
bypassing Codex's configured outbound proxy policy.

## What changed

- Build the updater's HTTP client from the effective Codex configuration so
  `features.respect_system_proxy` also applies to installer downloads.
- Use the route-aware client pool for the installer request.
- Warn and fall back to the default `reqwest` proxy behavior when configuration
  cannot be loaded, allowing updates to continue.

## Testing

Added tests for proxy-policy selection, configuration-load fallback, exact
installer URL usage, byte preservation, and non-success HTTP responses.

GitOrigin-RevId: 559668eb40314d43afa6512da66e59e32cc1b93c

codex-rs/deny.toml

@@ -242,7 +242,6 @@ deny = [
         "codex-agent-identity",
         "codex-api",
         "codex-app-server",
-        "codex-app-server-daemon",
         "codex-core",
         "codex-core-plugins",
         "codex-exec-server",