## What changed
- Add the `codex-windows-sandbox-service` workspace crate and Windows-only build target.
- Integrate `CodexSandboxService` with the Windows Service Control Manager, including start, stop, shutdown, status reporting, and event-log handling.
- Support service mode by default and a debug-only `--foreground` mode. Keep provisioning IPC disabled until authenticated request handling is available.
## Testing
- Add argument-parsing tests for service, foreground, unknown, and multiple arguments.
GitOrigin-RevId: 1c84f0a593b65e5cf97ab7606cde03675542b0b0
