fix(sandboxing): propagate managed DNS policy

[viyatb-oai]

Summary

• pass the launch-time domain policy to the Linux sandbox helper only when managed-network enforcement, local binding, proxy ports, and a nonempty allowlist are all active
• insert the serialized policy before the sandbox command separator without exposing it to the user command
• keep the existing behavior for disabled enforcement and incomplete managed-network contexts

Testing

• just test -p codex-network-proxy -p codex-sandboxing -p codex-exec-server-protocol -p codex-exec-server (576 passed)
• just fix -p codex-network-proxy -p codex-sandboxing -p codex-exec-server-protocol -p codex-exec-server -p codex-core -p codex-linux-sandbox
• Linux end-to-end coverage is included in feat(linux-sandbox): route DNS through managed proxy #31644

Stack: 3 of 3, on #31644.

Closes #22387.