feat: include NetworkConfig through ExecParams (#11105)

This PR adds the following field to `Config`:

```rust
pub network: Option<NetworkProxy>,
```

Though for the moment, it will always be initialized as `None` (this
will be addressed in a subsequent PR).

This PR does the work to thread `network` through to `execute_exec_env()`, `process_exec_tool_call()`, and `UnifiedExecRuntime.run()` to ensure it is available whenever we span a process.

codex-rs/network-proxy/src/proxy.rs

@@ -8,6 +8,7 @@ use crate::state::NetworkProxyState;
 use anyhow::Context;
 use anyhow::Result;
 use clap::Parser;
+use std::collections::HashMap;
 use std::net::SocketAddr;
 use std::sync::Arc;
 use tokio::task::JoinHandle;
@@ -89,11 +90,42 @@ pub struct NetworkProxy {
     policy_decider: Option<Arc<dyn NetworkPolicyDecider>>,
 }
 
+impl std::fmt::Debug for NetworkProxy {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        // Avoid logging internal state (config contents, derived globsets, etc.) which can be noisy
+        // and may contain sensitive paths.
+        f.debug_struct("NetworkProxy")
+            .field("http_addr", &self.http_addr)
+            .field("socks_addr", &self.socks_addr)
+            .field("admin_addr", &self.admin_addr)
+            .finish_non_exhaustive()
+    }
+}
+
+impl PartialEq for NetworkProxy {
+    fn eq(&self, other: &Self) -> bool {
+        self.http_addr == other.http_addr
+            && self.socks_addr == other.socks_addr
+            && self.admin_addr == other.admin_addr
+    }
+}
+
+impl Eq for NetworkProxy {}
+
 impl NetworkProxy {
     pub fn builder() -> NetworkProxyBuilder {
         NetworkProxyBuilder::default()
     }
 
+    pub fn apply_to_env(&self, env: &mut HashMap<String, String>) {
+        // Enforce proxying for all child processes when configured. We always override to ensure
+        // the proxy is actually used even if the caller passed conflicting environment variables.
+        let proxy_url = format!("http://{}", self.http_addr);
+        for key in ["HTTP_PROXY", "HTTPS_PROXY", "http_proxy", "https_proxy"] {
+            env.insert(key.to_string(), proxy_url.clone());
+        }
+    }
+
     pub async fn run(&self) -> Result<NetworkProxyHandle> {
         let current_cfg = self.state.current_cfg().await?;
         if !current_cfg.network.enabled {