Route executor policy audits through log-only telemetry (#38800)

## Why

Forwarded network policy decisions are audit telemetry and should not be
written to the persistent state log.

## What changed

- Emit forwarded `codex.network_proxy.policy_decision` events on the
  `codex_otel.log_only` target, keeping them available to OTEL log export while
  excluding them from persistent logs.
- Assert the log-only target in the existing trusted-metadata audit test.

GitOrigin-RevId: 16d07c8f390245036e4fa092a876012ef2b2fdba