codex sandbox help still describes Windows as restricted-token only

What happened?

The local codex sandbox docs/help still describe Windows as using a restricted-token sandbox.

Examples:

• codex-rs/README.md says Windows support runs commands under a restricted token.
• The CLI help for the Windows sandbox command says the command runs under a Windows restricted token sandbox.

The current debug sandbox implementation switches to an elevated backend when [windows].sandbox = "elevated", so the docs/help text no longer describes the full set of Windows sandbox modes.

Expected behavior

The docs/help text should mention the elevated Windows sandbox mode or otherwise describe Windows sandboxing in terms of the configured backend rather than restricted-token-only behavior.

Additional context

I searched open issues and PRs for terms including codex sandbox, Windows, restricted-token, elevated backend, and help/docs, and did not find an existing open item that appears to cover this specific local docs/help mismatch.