Codex now enforces network policy on redirects, streaming bodies and open WebSockets.

PR #47389 moves managed HTTP clients onto a policy-aware request builder: every redirect destination checked before routing, a permit held while response bodies stream, WebSocket reads and writes under revocable permits, and policy denials made non-retryable. Four follow-ups extend it to app-server, AWS auth, telemetry and remote-control traffic. Before this, a redirect or an already-open socket walked around your destination allowlist.