fix: Revert danger-full-access denylist-only mode (#17732)

## Summary

- Reverts openai/codex#16946 and removes the danger-full-access
denylist-only network mode.
- Removes the corresponding config requirements, app-server
protocol/schema, config API, TUI debug output, and network proxy
behavior.
- Drops stale tests that depended on the reverted mode while preserving
newer managed allowlist-only coverage.

## Verification

- `just write-app-server-schema`
- `just fmt`
- `cargo test -p codex-config network_requirements`
- `cargo test -p codex-core network_proxy_spec`
- `cargo test -p codex-core
managed_network_proxy_decider_survives_full_access_start`
- `cargo test -p codex-app-server map_requirements_toml_to_api`
- `cargo test -p codex-tui debug_config_output`
- `cargo test -p codex-app-server-protocol`
- `just fix -p codex-config -p codex-core -p codex-app-server-protocol
-p codex-app-server -p codex-tui`
- `git diff --cached --check`

Not run: full workspace `cargo test` (repo instructions ask for
confirmation before that broader run).

codex-rs/tui/src/debug_config.rs

@@ -367,7 +367,6 @@ fn format_network_constraints(network: &NetworkConstraints) -> String {
         dangerously_allow_all_unix_sockets,
         domains,
         managed_allowed_domains_only,
-        danger_full_access_denylist_only,
         unix_sockets,
         allow_local_binding,
     } = network;
@@ -405,11 +404,6 @@ fn format_network_constraints(network: &NetworkConstraints) -> String {
             "managed_allowed_domains_only={managed_allowed_domains_only}"
         ));
     }
-    if let Some(danger_full_access_denylist_only) = danger_full_access_denylist_only {
-        parts.push(format!(
-            "danger_full_access_denylist_only={danger_full_access_denylist_only}"
-        ));
-    }
     if let Some(unix_sockets) = unix_sockets {
         parts.push(format!(
             "unix_sockets={}",
@@ -605,7 +599,6 @@ mod tests {
                             NetworkDomainPermissionToml::Allow,
                         )]),
                     }),
-                    danger_full_access_denylist_only: Some(true),
                     ..Default::default()
                 },
                 RequirementSource::CloudRequirements,
@@ -676,7 +669,7 @@ mod tests {
         assert!(rendered.contains("mcp_servers: docs (source: MDM managed_config.toml (legacy))"));
         assert!(rendered.contains("enforce_residency: us (source: cloud requirements)"));
         assert!(rendered.contains(
-            "experimental_network: enabled=true, domains={example.com=allow}, danger_full_access_denylist_only=true (source: cloud requirements)"
+            "experimental_network: enabled=true, domains={example.com=allow} (source: cloud requirements)"
         ));
         assert!(!rendered.contains("  - rules:"));
     }