[codex] Tighten Windows sandbox refresh behavior

[bookholt-oai]

Summary

• Tighten a Windows sandbox refresh path.
• Preserve the required compatibility and explicit override behavior.
• Add regression coverage for the narrowed default behavior.

Validation

• cargo test -p codex-windows-sandbox --lib
• Attempted cargo check -p codex-windows-sandbox --target x86_64-pc-windows-msvc; this Linux host lacks the MSVC lib.exe tool required by ring, so that target compile could not complete locally.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}