windows-sandbox: fail elevated setup when firewall policy is ineffective (#22353)

## Why

Elevated Windows sandbox setup currently assumes that the firewall rules
it writes will take effect. On managed Windows hosts, local firewall
policy changes can be ignored or only partially apply across the active
profiles, which means setup can appear to succeed without providing the
expected network isolation.

## What changed

- Query `INetFwPolicy2::LocalPolicyModifyState` before configuring the
elevated sandbox firewall rules.
- Fail setup when Windows reports that local firewall policy edits are
ineffective or only apply to some current profiles.
- Surface that condition with a dedicated
`helper_firewall_policy_ineffective` setup error code so support and
IT-facing diagnostics can distinguish it from COM access failures.
- Add focused coverage for effective policy, group-policy override, and
partial-profile coverage cases.

## Testing

- `cargo test -p codex-windows-sandbox --bin
codex-windows-sandbox-setup`

codex-rs/windows-sandbox-rs/src/setup_error.rs

@@ -56,6 +56,8 @@ pub enum SetupErrorCode {
     HelperFirewallComInitFailed,
     /// Helper failed to access firewall policy or rule collections.
     HelperFirewallPolicyAccessFailed,
+    /// Helper detected that local firewall policy changes will not fully take effect.
+    HelperFirewallPolicyIneffective,
     /// Helper failed to create, update, or add the firewall rule.
     HelperFirewallRuleCreateOrAddFailed,
     /// Helper failed to verify the configured firewall rule scope.
@@ -91,6 +93,7 @@ impl SetupErrorCode {
             Self::HelperCapabilitySidFailed => "helper_capability_sid_failed",
             Self::HelperFirewallComInitFailed => "helper_firewall_com_init_failed",
             Self::HelperFirewallPolicyAccessFailed => "helper_firewall_policy_access_failed",
+            Self::HelperFirewallPolicyIneffective => "helper_firewall_policy_ineffective",
             Self::HelperFirewallRuleCreateOrAddFailed => {
                 "helper_firewall_rule_create_or_add_failed"
             }