feat(network-proxy): add policy-backed DNS service

[viyatb-oai]

Summary

Native DNS clients do not honor HTTP or SOCKS proxy variables, so they need a DNS-speaking path into the managed network proxy rather than direct resolver access.

• add a private, loopback-only framed DNS endpoint to the managed proxy lifecycle
• evaluate live domain and local-address policy around a single host lookup, then synthesize bounded A/AAAA responses
• preserve execution attribution when supplied, use baseline policy for unscoped requests, and reject unknown tokens
• bound connection concurrency, handshakes, frames, lookups, answers, and response size
• audit and report policy denials through the existing blocked-request path

Testing

• just test -p codex-network-proxy

Stack: 1 of 2. Next: #31644.