Require the elevated Windows sandbox for network proxies (#32857)

## Why

Network proxy enforcement on Windows requires the elevated sandbox backend. Silently selecting that backend for an unelevated configuration makes the effective sandbox differ from the configured mode.

## What changed

- Reject enabled network proxy configurations on Windows unless managed requirements allow only the elevated sandbox and `windows.sandbox` resolves to `"elevated"`.
- Preserve the configured sandbox backend during execution and validate proxy compatibility at config loading, sandbox setup, and process launch boundaries.
- Defer this validation during cloud-config bootstrap so authoritative managed requirements can be loaded first.
- Do not start or expose disabled Windows proxies, and render transitions to disabled networking as `<network enabled="false"></network>`.

## Testing

- Cover Windows requirement and sandbox compatibility matrices, bootstrap behavior, backend selection, disabled proxy handling, and environment-context updates.

GitOrigin-RevId: bfa1dda98594e0db61883f8e7f65bd560e3453e6

codex-rs/config/src/constraint.rs

@@ -33,6 +33,16 @@ pub enum ConstraintError {
         requirement_source: RequirementSource,
         reason: String,
     },
+
+    #[error(
+        "network proxy configuration requires `[windows] allowed_sandbox_implementations = [\"elevated\"]` in requirements"
+    )]
+    NetworkProxyRequiresElevatedWindowsSandboxRequirement,
+
+    #[error(
+        "the network proxy is incompatible with the unelevated Windows sandbox; set `windows.sandbox = \"elevated\"` or disable the network proxy"
+    )]
+    NetworkProxyIncompatibleWithUnelevatedWindowsSandbox,
 }
 
 impl ConstraintError {
@@ -41,6 +51,14 @@ impl ConstraintError {
             field_name: field_name.into(),
         }
     }
+
+    pub fn is_windows_network_configuration_error(&self) -> bool {
+        matches!(
+            self,
+            Self::NetworkProxyRequiresElevatedWindowsSandboxRequirement
+                | Self::NetworkProxyIncompatibleWithUnelevatedWindowsSandbox
+        )
+    }
 }
 
 pub type ConstraintResult<T> = Result<T, ConstraintError>;