## What changed
- Add the stable, default-enabled `in_app_updates` requirements-only feature.
- Allow administrators to disable in-app updates through `[features]` in `requirements.toml`.
- Expose the policy through `configRequirements/read` and include it in the config schema.
## Testing
- Verify that in-app updates are enabled by default and disabled by the managed requirement.
- Verify that `configRequirements/read` returns the configured policy.
GitOrigin-RevId: e9c7074b516fe58385fdf7dc8420c0109c0c3df6
## What changed
- Add a console mode to the Windows sandbox process launcher.
- Launch `--codex-run-as-fs-helper` subprocesses with `CREATE_NO_WINDOW`.
- Preserve inherited-console behavior for regular sandboxed commands.
GitOrigin-RevId: 927be36b82903b6a5fb1a243ba7f406f9ed85f3f