fix(buzz-acp): inject Codex network allowlist for relay hostname at spawn time

[wpfleger96]

Problem

Codex sandboxes MCP subprocesses (including buzz-cli) behind a local proxy (127.0.0.1:3128) with a domain allowlist. When buzz-acp spawns codex-acp, buzz-cli requests to the relay are blocked before they reach WARP or any other outbound path — because the relay hostname isn't in Codex's allowlist.

{"error":"network_error","message":"network error: error sending request for url (https://sprout-oss.stage.blox.sqprod.co/query)"}

Fix

When buzz-acp spawns a Codex agent, parse the relay hostname from BUZZ_RELAY_URL and prepend -c flag pairs to the agent args that configure Codex's network proxy to allow that hostname:

-c network_proxy.mode="full"
-c network_proxy.domains."<host>"="allow"

These keys map to NetworkProxyConfigToml in codex-acp's config schema — mode="full" enables the managed proxy for all outbound traffic, and domains is the per-hostname allowlist map.

Implementation

crates/buzz-acp/src/config.rs

• Add codex_network_args(agent_command, relay_url) -> Vec<String> — uses url::Url::parse() to extract the hostname (handles ws://, wss://, http://, https://; port stripped automatically). On parse failure, logs a warning and returns empty rather than panicking. Logs tracing::debug! at injection time for version-coupling diagnosability.
• In Config::from_cli(), prepend the result to agent_args after normalize_agent_args(). Single injection point — all spawn paths (initial, respawn, refill) pick up the flags automatically with no changes to lib.rs.
• No new dependencies — url crate was already a workspace dep in buzz-acp/Cargo.toml.

Tests

9 unit tests covering:

• wss:// relay URL (production case — the failing scenario)
• ws:// with port (local dev default)
• https:// with path
• http:// with port and path
• Bare codex command (not just codex-acp)
• Full path command (/usr/local/bin/codex-acp)
• Non-Codex agents return empty (goose, claude-agent-acp, buzz-agent)
• Empty relay URL returns empty (parse failure → graceful skip)
• Schemeless string returns empty (parse failure → graceful skip)

Note on spike confirmation

The network_proxy key format was confirmed via binary analysis of codex-acp v0.15.0 by Thufir — NetworkProxyConfigToml struct fields are visible in the binary. A live end-to-end session confirmation (relay request succeeds through the sandbox) has not been run. If that is a hard gate before merge, flag it.