feat(sandbox): enforce proxy-aware network routing in sandbox (#11113)

## Summary
- expand proxy env injection to cover common tool env vars
(`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`/`NO_PROXY` families +
tool-specific variants)
- harden macOS Seatbelt network policy generation to route through
inferred loopback proxy endpoints and fail closed when proxy env is
malformed
- thread proxy-aware Linux sandbox flags and add minimal bwrap netns
isolation hook for restricted non-proxy runs
- add/refresh tests for proxy env wiring, Seatbelt policy generation,
and Linux sandbox argument wiring

codex-rs/core/src/tasks/user_shell.rs

@@ -23,7 +23,7 @@ use crate::protocol::ExecCommandEndEvent;
 use crate::protocol::ExecCommandSource;
 use crate::protocol::SandboxPolicy;
 use crate::protocol::TurnStartedEvent;
-use crate::sandboxing::ExecEnv;
+use crate::sandboxing::ExecRequest;
 use crate::sandboxing::SandboxPermissions;
 use crate::state::TaskKind;
 use crate::tools::format_exec_output_str;
@@ -140,13 +140,14 @@ pub(crate) async fn execute_user_shell_command(
         )
         .await;
 
-    let exec_env = ExecEnv {
+    let exec_env = ExecRequest {
         command: exec_command.clone(),
         cwd: cwd.clone(),
         env: create_env(
             &turn_context.shell_environment_policy,
             Some(session.conversation_id),
         ),
+        network: turn_context.config.network.clone(),
         // TODO(zhao-oai): Now that we have ExecExpiration::Cancellation, we
         // should use that instead of an "arbitrarily large" timeout here.
         expiration: USER_SHELL_TIMEOUT_MS.into(),
@@ -164,14 +165,9 @@ pub(crate) async fn execute_user_shell_command(
     });
 
     let sandbox_policy = SandboxPolicy::DangerFullAccess;
-    let exec_result = execute_exec_env(
-        exec_env,
-        &sandbox_policy,
-        stdout_stream,
-        turn_context.config.network.clone(),
-    )
-    .or_cancel(&cancellation_token)
-    .await;
+    let exec_result = execute_exec_env(exec_env, &sandbox_policy, stdout_stream)
+        .or_cancel(&cancellation_token)
+        .await;
 
     match exec_result {
         Err(CancelErr::Cancelled) => {