exec-server: start managed network proxy on executor

[viyatb-oai]

Summary

• send a sanitized effective managed-network policy to remote exec-server processes
• start and own HTTP/SOCKS proxy listeners on the executor, then derive child env and sandbox ports locally
• fail closed for MITM, credential injection, and hook configuration until that boundary is implemented

Why

Core currently prepares orchestrator-local loopback endpoints for remote commands. The remote sandbox receives those ports, but exec-server never creates a reachable proxy on the executor, so managed networking fails closed without usable egress.

Testing

• just test -p codex-exec-server remote_proxy_config_starts_executor_local_proxy
• just test -p codex-exec-server-protocol
• new codex-network-proxy policy conversion tests passed in the crate run; four unrelated MITM certificate tests could not write to the sandboxed ~/.codex/proxy

Stack follow-up: preserve inline Guardian network decisions across the exec-server transport.