## What changed
- Add a client for the packaged Windows sandbox provisioning service that verifies the named-pipe server belongs to the running `CodexSandboxService` process before exchanging a versioned provisioning request.
- Treat an absent, busy, timed-out, or disconnected service as unavailable while surfacing provisioning and authentication failures.
- Send the complete `WindowsSandboxProvisioningSettings` and classify inherited HTTP and SOCKS proxy listeners separately for managed-policy validation.
- Share bounded frame-readiness handling between runner and provisioning IPC.
## Testing
- Extend proxy environment tests to cover network-enabled profiles, mixed HTTP and SOCKS listeners, explicit proxy-port overrides, case-insensitive schemes, and unclassified protocols.
GitOrigin-RevId: 6ff6741fc3ecd76314a7a045523a8d7a7e7af686
## What changed
- Define a versioned, length-prefixed JSON request/response protocol for the
machine-wide Windows sandbox provisioning service, including its named pipe
and network setup parameters.
- Add a readiness check that compares the recorded proxy ports and local-binding
policy with the requested provisioning settings.
- Share framed JSON I/O, sandbox-group creation, and SID resolution between the
existing elevated setup path and provisioning clients.
GitOrigin-RevId: d6250542d06f7646ffeb92150472e7d7fa1e5e66
johnl-oai