feat: worker group toggle to keep the worker's proxy out of jobs (#11958)

* feat: worker group setting to strip env vars from the nsjail sandbox

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: apply the nsjail env denylist to profile envar directives too

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* refactor: drop the nsjail env denylist spawn hook

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat: replace the nsjail env denylist with a worker group toggle for the job proxy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: honor the job proxy toggle in duckdb and drop the env var fallback

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix: pre-install duckdb extensions with the proxy when jobs run without it

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: update ee-repo-ref to 5cfc0dc6760ea7f631fc98ea1edd39adfc55bf11

This commit updates the EE repository reference after PR #914 was merged in windmill-ee-private.

Previous ee-repo-ref: 8394f2d1b67765ba854205836185342e62df841e

New ee-repo-ref: 5cfc0dc6760ea7f631fc98ea1edd39adfc55bf11

Automated by sync-ee-ref workflow.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: windmill-internal-app[bot] <windmill-internal-app[bot]@users.noreply.github.com>

backend/src/monitor.rs

@@ -441,6 +441,7 @@ pub async fn initial_load(
                     cache_clear: None,
                     additional_python_paths: None,
                     pip_local_dependencies: None,
+                    disable_job_proxy: false,
                     native_mode,
                     // an agent worker never reads its group's config, only its token
                     object_store_cache_config: None,