Fix Windows Command Center sandbox fallback and provider repair

[awtprod]

What changed

• Remove the Windows Command Center retry through Codex's unelevated sandbox.
• Require the elevated native Windows sandbox for Command Center's workspace-only permission profile and surface actionable administrator-approval guidance.
• Keep the provider update action available when Codex is current so users can update or reinstall a damaged native package from Settings.
• Update the Codex provider guide and regression coverage.

Why

The unelevated Windows restricted-token sandbox cannot enforce Command Center's split filesystem read policy. Retrying with that mode produced an unsupported-operation error after the elevated attempt failed. Separately, the in-app provider update control was hidden unless a newer version was detected, so it could not repair a current-but-incomplete Codex installation.

Impact

Windows Command Center now fails closed with a clear setup action instead of attempting an unsupported sandbox mode. Managed Codex installations expose an Update or reinstall action in provider settings even when their reported version is current.

Validation

• 115 focused server tests passed.
• 3 focused web tests passed.
• Server and web typechecks passed.
• Focused lint, formatting, diff checks, and repository pre-commit checks passed.