[codex] Stop Windows sandbox setup after filter installation failure

[bookholt-oai]

What changed

• Treat Windows sandbox filter installation failures as setup failures.
• Preserve the existing logging and telemetry around filter installation.
• Avoid reporting offline sandbox setup as successful when its required filter setup did not complete.

Validation

• cargo test -p codex-windows-sandbox
• cargo check -p codex-windows-sandbox --target x86_64-pc-windows-msvc attempted; blocked on this Linux host by missing MSVC tooling (lib.exe).
• python3 tools/argument-comment-lint/run-prebuilt-linter.py attempted; blocked while compiling unrelated Linux sandbox support because libcap.pc is unavailable in this environment.

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}