Cowork VM egress allowlist ignores Admin Capabilities network access settings

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Admin Capabilities network access allowlist is not respected by the Cowork sandbox's egress proxy. I set Organization settings → Capabilities → Network Access to "Specific allowed domains" and added api.scryfall.com (also tested www.google.com, www.youtube.com), but requests to these domains from an active Cowork session still fail with a 403 at the proxy CONNECT stage. Only the hardcoded default domains (api.anthropic.com, pypi.org, registry.npmjs.org, api.github.com, etc.) are actually allowed through, regardless of what's configured in the admin UI.

### What Should Happen?

Requests to any domain I've explicitly added to the Capabilities → Network Access allowlist should succeed, since that's what the admin setting is for.

### Error Messages/Logs

```shell
curl -sS https://api.scryfall.com/cards/random
curl: (56) CONNECT tunnel failed, response 403

Proxy status endpoint (/__agentproxy/status) recentRelayFailures:
{
"kind": "connect_rejected",
"detail": "gateway answered 403 to CONNECT (policy denial or upstream failure)",
"host": "api.scryfall.com:443"
}

The noProxy list returned by the same status endpoint only ever shows the hardcoded defaults, never the domains I added via the admin settings.
```

### Steps to Reproduce

1. In org admin settings, go to Capabilities → Network Access, select "Specific allowed domains", add api.scryfall.com, save.
2. Start (or continue) a Cowork session.
3. Run a request to the allowlisted domain, e.g.:
curl https://api.scryfall.com/cards/random
(also reproduces via the WebFetch tool on the same URL)
4. Expected: request succeeds.
5. Actual: request fails with 403 at the CONNECT stage. The proxy status endpoint confirms the domain is not present in the effective allowlist.

### Claude Model

Not sure / Multiple models

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

1.52386.0 (1003ca)

### Platform

Other

### Operating System

Windows

### Terminal/Shell

Other

### Additional Information

This is happening in Cowork mode (Claude desktop app), not the Claude Code CLI — the "Terminal/Shell" and "Platform" fields don't have an exact match for this context, selected closest option.

This matches existing reports: anthropics/claude-code#23818, anthropics/claude-code#51400

Reproduce in a Cowork session by adding a domain under Organization settings → Capabilities → Network Access, then run curl and inspect /__agentproxy/status. Start by tracing how the Cowork egress proxy builds its effective noProxy/allowlist from admin settings. Done means configured domains appear in the proxy status allowlist and CONNECT requests to them succeed instead of returning 403.

Written by the indexing model from the issue text.