feat(sandbox): enforce proxy-aware network routing in sandbox (#11113)

## Summary
- expand proxy env injection to cover common tool env vars
(`HTTP_PROXY`/`HTTPS_PROXY`/`ALL_PROXY`/`NO_PROXY` families +
tool-specific variants)
- harden macOS Seatbelt network policy generation to route through
inferred loopback proxy endpoints and fail closed when proxy env is
malformed
- thread proxy-aware Linux sandbox flags and add minimal bwrap netns
isolation hook for restricted non-proxy runs
- add/refresh tests for proxy env wiring, Seatbelt policy generation,
and Linux sandbox argument wiring

codex-rs/linux-sandbox/README.md

@@ -26,6 +26,8 @@ into this binary.
   writable roots are blocked by mounting `/dev/null` on the symlink or first
   missing component.
 - When enabled, the helper isolates the PID namespace via `--unshare-pid`.
+- When enabled and network is restricted without proxy routing, the helper also
+  isolates the network namespace via `--unshare-net`.
 - When enabled, it mounts a fresh `/proc` via `--proc /proc` by default, but
   you can skip this in restrictive container environments with `--no-proc`.