mcp: remove codex/sandbox-state custom request support

[bolinfest]

Why

#17763 moved sandbox-state delivery for MCP tool calls to request _meta via the codex/sandbox-state-meta experimental capability. Keeping the older codex/sandbox-state capability meant Codex still maintained a second transport that pushed updates with the custom codex/sandbox-state/update request at server startup and when the session sandbox policy changed.

That duplicate MCP path is redundant with the per-tool-call metadata path and makes the sandbox-state contract larger than needed. The existing managed network proxy refresh on sandbox-policy changes is still needed, so this keeps that behavior separate from the removed MCP notification.

What Changed

• Removed the exported MCP_SANDBOX_STATE_CAPABILITY and MCP_SANDBOX_STATE_METHOD constants.
• Removed detection of codex/sandbox-state during MCP initialization and stopped sending codex/sandbox-state/update at server startup.
• Removed the McpConnectionManager::notify_sandbox_state_change plumbing while preserving the managed network proxy refresh when a user turn changes sandbox policy.
• Slimmed McpConnectionManager::new so startup paths pass only the initial SandboxPolicy needed for MCP elicitation state.
• Kept codex/sandbox-state-meta support intact; servers that opt in still receive the current SandboxState on tool-call request _meta (remaining call path).
• Added regression coverage for refreshing the live managed network proxy on a per-turn sandbox-policy change.

Verification

• cargo test -p codex-core new_turn_refreshes_managed_network_proxy_for_sandbox_change
• cargo test -p codex-mcp