P0: enforce Enabled network via isolated netns and managed proxy

[novelKR]

Summary

• Adds SandboxNetwork::Enabled mapped to Codex Enabled + --allow-network-for-proxy. Restricted stays --unshare-net + Restricted seccomp exec; Enabled starts helper-owned NetworkProxy then spawn+waits Codex argv.
• Operator workspace JSON network (restricted | enabled, default restricted) selects the axis. MCP profiles and LIVE_TOOLS are unchanged; { "network": true } is not a grant. Probe failure + Enabled is PROCESS_SPAWN_FAILED (no host FullAccess fallback).
• workspace_info advertises enforcement=enforced for both axes when the Linux helper wraps spawn. Bilingual docs + prepare/isolation/MCP tests.

Test plan

• cargo test -p codespace-linux-sandbox-protocol -p codespace-policy -p codespace-domain -p codespace-runner -p codespace-server
• cargo test --manifest-path crates/linux-sandbox/Cargo.toml (Linux CI with CODESPACE_REQUIRE_LINUX_SANDBOX=1 for isolation HTTP-via-proxy)
• scripts/check-no-model-deps.sh and python3 -B scripts/check_docs.py check
• Confirm default workspace network.policy=restricted; operator network: enabled advertises enabled without raising Write/Exec

Made with Cursor