perf(config): defer remote sandbox hostname lookup

[fcoury-oai]

Why

#18763 added canonical hostname resolution for remote_sandbox_config. Requirements composition currently performs that synchronous DNS lookup on every fresh process, even when none of the loaded requirements layers contains [[remote_sandbox_config]]. On hosts with slow local DNS resolution, this can add several seconds to Codex startup.

What

• defer hostname resolution until a parsed requirements layer actually contains remote_sandbox_config
• cache the resolver result once per requirements composition, preserving the existing single-lookup behavior across multiple layers
• keep the existing FQDN resolution and per-layer requirements precedence unchanged
• cover both the ordinary no-lookup path and the multi-layer single-lookup path

How to Test

On a host where local canonical-name resolution is slow:

1. Start Codex without [[remote_sandbox_config]] in any managed requirements layer and confirm startup no longer waits for hostname resolution.
2. Add a matching [[remote_sandbox_config]] entry and confirm its allowed_sandbox_modes still overrides the layer's top-level value.
3. Add remote sandbox entries to multiple requirements layers and confirm precedence remains unchanged while the hostname is resolved only once.

Targeted tests:

• just test -p codex-config hostname_resolver
• just test -p codex-config (181 passed)