Improve codex doctor network diagnostics (#38918)

## What changed

- Probe the configured Responses inference endpoint with Codex's route-aware HTTP client, including configured proxy and custom CA behavior.
- Classify TLS, proxy authentication, proxy configuration, resolution, and timeout failures into actionable diagnostics.
- Report privacy-safe macOS system proxy state and suggest enabling `respect_system_proxy` when a configured proxy is otherwise unused.
- Preserve system-root fallback when a custom CA is invalid, and account for provider-specific API key configuration when selecting the probe route.

## Testing

- Cover inference endpoint selection, invalid custom CA fallback, proxy authentication failures, TLS classification, and macOS proxy reporting.

GitOrigin-RevId: c30a3ca5a332119e2b2f8c65341ef9b2251a28a2

codex-rs/http-client/src/outbound_proxy/macos.rs

@@ -5,6 +5,7 @@ use std::ptr;
 use std::time::Duration;
 use std::time::Instant;
 
+use super::MacosSystemProxyConfiguration;
 use super::RequestOrigin;
 use super::RouteFailureClass;
 use super::SystemProxyDecision;
@@ -102,6 +103,39 @@ pub(super) fn resolve(request_url: &str, origin: &RequestOrigin) -> SystemProxyD
     proxy_array_decision(&proxies, &target_url, origin)
 }
 
+pub(super) fn configuration(request_url: &str) -> MacosSystemProxyConfiguration {
+    let Some(target_url) = cf_url(request_url) else {
+        return MacosSystemProxyConfiguration::Unavailable;
+    };
+    let Some(settings) = system_proxy_settings() else {
+        return MacosSystemProxyConfiguration::Unavailable;
+    };
+    let Some(proxies) = copy_proxies_for_url(&target_url, &settings) else {
+        return MacosSystemProxyConfiguration::Unavailable;
+    };
+
+    (&proxies)
+        .into_iter()
+        .find_map(|proxy| {
+            let proxy_type = cf_string_value(&proxy, unsafe { kCFProxyTypeKey })?;
+            if cf_string_equals(&proxy_type, unsafe { kCFProxyTypeAutoConfigurationURL })
+                || cf_string_equals(&proxy_type, unsafe {
+                    kCFProxyTypeAutoConfigurationJavaScript
+                })
+            {
+                Some(MacosSystemProxyConfiguration::Automatic)
+            } else if cf_string_equals(&proxy_type, unsafe { kCFProxyTypeHTTP })
+                || cf_string_equals(&proxy_type, unsafe { kCFProxyTypeHTTPS })
+            {
+                Some(MacosSystemProxyConfiguration::Manual)
+            } else {
+                cf_string_equals(&proxy_type, unsafe { kCFProxyTypeNone })
+                    .then_some(MacosSystemProxyConfiguration::Direct)
+            }
+        })
+        .unwrap_or(MacosSystemProxyConfiguration::Unavailable)
+}
+
 fn system_proxy_settings() -> Option<CFDictionary<CFString, CFType>> {
     let store = SCDynamicStoreBuilder::new("Codex").build()?;
     store.get_proxies()