Windows sandbox setup refresh fails with os error 740 for shell commands

### Summary
Shell commands executed via Codex (example: rg --files) now fail immediately with:
execution error: Io(Custom { kind: Other, error: "windows sandbox: spawn setup refresh" }).

Running the same commands directly outside Codex succeeds, so this appears to be a Windows sandbox setup regression.

Observed log pattern

• setup refresh: failed to spawn codex-windows-sandbox-setup.exe: The requested operation requires elevation. (os error 740)
• Repeats on each command invocation before command output.

Versions

• codex-cli: 0.137.0
• Windows sandbox mode is configured as elevated

If helpful I can provide a full reproduction timeline.