[codex] compact network context rendering

[sayan-oai]

Why

The model-visible <network> context currently repeats indentation and a pair of XML tags for every allowed or denied domain. Large domain sets spend a surprising amount of prompt budget on that scaffolding instead of the actual policy values.

What changed

• Render allowed domains as one comma-separated <allowed> value instead of one element per domain.
• Render denied domains the same way.
• Keep the full allow/deny domain sets model-visible while updating the serialization and settings-update coverage for the denser shape.

Example

Before:

<network enabled="true">
  <allowed>api.example.test</allowed>
  <allowed>cdn.example.test</allowed>
  <denied>blocked.example.test</denied>
</network>

After:

<network enabled="true"><allowed>api.example.test,cdn.example.test</allowed><denied>blocked.example.test</denied></network>

Validation

• cargo test -p codex-core environment_context
• cargo test -p codex-core build_settings_update_items_emits_environment_item_for_network_changes
• Ran a local codex session with a real network context containing 121 allowed domains and 42 denied domains, then inspected the raw prompt with raw_token_viewer_cli.py. With the same domain set, the rendered <network> section shrank from 7,175 characters across 161 lines to 3,666 characters on one line, and the containing environment-context block fell from 6,428 tokens to 5,379 tokens.