Cowork VM egress allowlist ignores Admin Capabilities network access settings

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

Admin Capabilities network access allowlist is not respected by the Cowork sandbox's egress proxy. I set Organization settings → Capabilities → Network Access to "Specific allowed domains" and added api.scryfall.com (also tested www.google.com, www.youtube.com), but requests to these domains from an active Cowork session still fail with a 403 at the proxy CONNECT stage. Only the hardcoded default domains (api.anthropic.com, pypi.org, registry.npmjs.org, api.github.com, etc.) are actually allowed through, regardless of what's configured in the admin UI.

### What Should Happen?

Requests to any domain I've explicitly added to the Capabilities → Network Access allowlist should succeed, since that's what the admin setting is for.

### Error Messages/Logs

```shell
curl -sS https://api.scryfall.com/cards/random
curl: (56) CONNECT tunnel failed, response 403

Proxy status endpoint (/__agentproxy/status) recentRelayFailures:
{
"kind": "connect_rejected",
"detail": "gateway answered 403 to CONNECT (policy denial or upstream failure)",
"host": "api.scryfall.com:443"
}

The noProxy list returned by the same status endpoint only ever shows the hardcoded defaults, never the domains I added via the admin settings.
```

### Steps to Reproduce

1. In org admin settings, go to Capabilities → Network Access, select "Specific allowed domains", add api.scryfall.com, save.
2. Start (or continue) a Cowork session.
3. Run a request to the allowlisted domain, e.g.:
curl https://api.scryfall.com/cards/random
(also reproduces via the WebFetch tool on the same URL)
4. Expected: request succeeds.
5. Actual: request fails with 403 at the CONNECT stage. The proxy status endpoint confirms the domain is not present in the effective allowlist.

### Claude Model

Not sure / Multiple models

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

1.52386.0 (1003ca)

### Platform

Other

### Operating System

Windows

### Terminal/Shell

Other

### Additional Information

This is happening in Cowork mode (Claude desktop app), not the Claude Code CLI — the "Terminal/Shell" and "Platform" fields don't have an exact match for this context, selected closest option.

This matches existing reports: anthropics/claude-code#23818, anthropics/claude-code#51400

Reproduce in a Cowork session by adding a domain under Organization settings → Capabilities → Network Access, then run curl and inspect /__agentproxy/status. Start by tracing how the Cowork egress proxy builds its effective noProxy/allowlist from admin settings. Done means configured domains appear in the proxy status allowlist and CONNECT requests to them succeed instead of returning 403.

由索引模型根据 Issue 内容生成。