feat: surface codex windows sandbox progress

tests/local-agent-codex-app-server-runner.test.mjs

@@ -458,9 +458,15 @@ test("codex app-server runner maps runtime status events without leaking interna
       serverName: "Mac Studio",
       environmentId: "env-prod",
     });
+    assert.deepEqual(result.executionProgress.windowsSandbox, {
+      status: "failed",
+      setupMode: "elevated",
+      error: "token=[redacted] failed in [path]",
+    });
     const serialized = JSON.stringify(result.executionProgress);
     assert.equal(serialized.includes("install-secret-should-not-leak"), false);
     assert.equal(serialized.includes("sk-secret-should-not-leak"), false);
+    assert.equal(serialized.includes("C:\\Users\\kris\\secret"), false);
   } finally {
     if (previous === undefined) {
       delete process.env.BOSS_CODEX_APP_SERVER_FIXTURE_EMIT_RUNTIME_STATUS;