Extract shared Windows sandbox session runner

[iceweasel-oai]

Why

This is the first PR in a stack for the Windows fs-helper sandbox fix. Before changing fs-helper behavior, this pulls the reusable Windows sandbox session launch pieces out of the debug CLI path so later PRs can call the same backend selection and stdio forwarding logic.

Keeping this as a pure refactor makes the later security fix easier to review: codex sandbox windows should continue to launch the same elevated or restricted-token backend, just through shared APIs in windows-sandbox-rs instead of code local to cli/src/debug_sandbox.rs.

What Changed

• Added WindowsSandboxSessionRequest and spawn_windows_sandbox_session_for_level() in windows-sandbox-rs to share the elevated-vs-legacy session launch decision.
• Moved the Windows sandbox stdio forwarding helpers from cli/src/debug_sandbox.rs into windows-sandbox-rs/src/stdio_bridge.rs.
• Updated codex sandbox windows to call the shared session launcher and stdio bridge.
• Added unit coverage for the moved stdio forwarding helpers.

Verification

• just bazel-lock-update
• just bazel-lock-check
• just test -p codex-windows-sandbox stdio_bridge::tests
• just fix -p codex-windows-sandbox -p codex-sandboxing -p codex-exec-server -p codex-arg0 -p codex-core -p codex-file-system
• The new stdio_bridge tests also passed as part of just test -p codex-windows-sandbox on the stack tip. That full local run still fails in pre-existing legacy session integration tests with CreateRestrictedToken failed: 87 on this workstation.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 328cff02bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".