Function resolve_provider_native_launch_overlay 

pub fn resolve_provider_native_launch_overlay(
    provider: &str,
    approval_level: ApprovalLevel,
    native: &ProviderNativeNetworkSketch,
) -> Result<Vec<String>, String>

Resolve provider-native launch overlay argv for a catalog entry, or refuse.

Empty when native is empty / unset. Codex Moderate + Some(flag) yields codex_network_access_config_overlay. Other cases refuse via provider_native_mapping_supported.

Claude settings-domain overlay is not provider_native — see claude_allowed_domains_from_permits / server resolve path.