Codex Cloud internet set to unrestricted, but outbound HTTPS blocked (CONNECT 403 via proxy)

With Agent internet access set to On: unrestricted, the cloud task environment cannot reach public HTTPS endpoints.

DNS resolution succeeds, but HTTPS requests fail through a configured proxy with CONNECT tunnel failed, response 403 (Envoy). Direct outbound HTTPS without proxy also fails.

This makes internet effectively unavailable despite unrestricted setting.

Steps to reproduce

1. Set environment internet access to On: unrestricted.
2. node -e "require('dns').promises.lookup('example.com').then(console.log)"

curl -I https://example.com --max-time 12
env | rg -i '^(http|https|all)_proxy=|^no_proxy='
HTTPS_PROXY= HTTP_PROXY= curl -I https://example.com --max-time 12

Expected behavior
General internet endpoints should be reachable when internet is unrestricted.

Actual behavior
Connectivity check fails all endpoints.
DNS lookup works.
HTTPS via proxy fails with CONNECT ... 403.
Direct outbound HTTPS without proxy also fails.
Additional context
Same workflow succeeds in local Codex sessions and fails in cloud environment.
This blocks cloud tasks that depend on external downloads.