test(core): cover remote Guardian allow and deny

[viyatb-oai]

Stacks on #31458.

Summary

• exercise a remote executor network request denied by Guardian
• exercise a second remote executor request allowed by Guardian and assert the executor-side request completes
• cover the full core -> exec-server transport -> executor-local proxy decision path

Testing

• just fmt
• targeted codex-core test compiled through the test graph locally; the final link exhausted local disk, so CI is the clean-runner validation