PAC 5 - Add network proxy system proxy routing

[canvrno-oai]

Summary

• Stacks on PAC 4 - Add macOS system proxy resolver #26709 and extends respect_system_proxy to sandboxed command egress through network-proxy.
• When enabled, HTTP, CONNECT, and MITM upstream requests use system proxy/PAC/WPAD resolution, then environment proxy variables, then DIRECT.
• Leaves existing network-proxy behavior unchanged when the feature is disabled.

Implementation

• Exposes the shared URL-specific system proxy route decision from codex-client.
• Carries respect_system_proxy into the network-proxy runtime configuration.
• Resolves each target URL before HTTP, CONNECT, and MITM upstream routing.
• Converts supported HTTP proxy routes for the upstream client; unavailable, invalid, or unsupported system routes fall back to environment proxy settings.
• Preserves direct routing when upstream proxies are disallowed.

Known limitation

Only the first supported system/PAC proxy candidate is used. A connection failure does not currently advance to subsequent proxy or DIRECT candidates. This matches the current native-client behavior and leaves ordered fallback support for a future improvement.

Tests

• just test -p codex-client -p codex-network-proxy (209 passed)
• just test -p codex-core --lib (1,893 passed; 3 skipped)
• just clippy -p codex-client -p codex-network-proxy -p codex-core
• just fmt
• just bazel-lock-check

[viyatb-oai]

One runtime responsiveness issue to address in the network-proxy integration.

[github-actions]

Closing this pull request because it has had no updates for more than 14 days. If you plan to continue working on it, feel free to reopen or open a new PR.