Split a multi-line AI_SBX_NETWORK correctly

A long host list is naturally written as a multi-line TOML string, but read
stops at the first newline, so only the first host was ever allowed. The rest
failed later as connection errors with nothing pointing back at the list.

Newlines and carriage returns are now flattened alongside commas before
splitting, and the test covers a multi-line value; it fails without the fix.

Also records the measured host requirements for a full Neovim configuration.
The Balanced policy already permits github, npm, pypi, crates, go, ubuntu,
nodejs, hashicorp releases, Copilot and the LLM APIs, which covers 93 lazy.nvim
plugins, both mason registries and all 55 mason packages. Only the .NET and
Terraform registries need declaring.

docs/tmux-workspace-plan.md

@@ -164,9 +164,9 @@ expect ≥ 0.10. Prefer the upstream tarball or keep it on mise rather than `apt
 .config/nvim/       the smallest config that is pleasant on a fresh machine
 ```
 
-Keep the nvim config deliberately minimal. A plugin-manager bootstrap that fetches
-from the network on first launch will hit the default-deny policy, and debugging that
-inside a microVM is a bad first experience.
+Ship the **full** config. The network objection that would have argued for trimming it
+does not survive measurement — see below — so the only real cost is a slower first
+launch while plugins and LSP servers download.
 
 ### The launcher
 
@@ -293,22 +293,44 @@ Setting a distinct prefix in the sandbox `.tmux.conf` avoids a confusing fight o
 **Terminal type.** `TERM` must survive into the sandbox or nvim renders badly.
 `sbx exec -t` should handle it; confirm rather than assume.
 
-**LazyVim bootstrap — measured, and not a problem.** Every host the config needs is
-already permitted by the `Balanced` policy, checked individually with
-`sbx policy check network`:
+**Plugin bootstrap — measured host by host with `sbx policy check network`.**
+
+Already permitted by `Balanced`, so nothing to declare:
 
 ```text
-github.com  codeload.github.com  raw/objects.githubusercontent.com   Allowed
-registry.npmjs.org  pypi.org  files.pythonhosted.org                 Allowed
-crates.io  static.crates.io  proxy.golang.org  sum.golang.org        Allowed
+github.com  codeload.github.com  raw/objects.githubusercontent.com
+registry.npmjs.org  pypi.org  files.pythonhosted.org
+crates.io  static.crates.io  proxy.golang.org  sum.golang.org
+nodejs.org  deb.debian.org  archive/security.ubuntu.com
+releases.hashicorp.com  checkpoint-api.hashicorp.com
+api.githubcopilot.com  copilot-proxy.githubusercontent.com
+api.anthropic.com  api.openai.com
 ```
 
-That covers all 93 pinned lazy.nvim plugins and all 55 mason packages (22 npm, 4 pypi,
-29 GitHub releases). First launch will be slow, not blocked.
+That covers all 93 pinned lazy.nvim plugins, both mason registries (`mason-org` and
+`crashdummyy`, both `github:`), all 55 mason packages, Copilot, and codecompanion.
 
-The hosts that *were* denied are the work ones — `npm.fontawesome.com`,
-`proget.careevolution.com`, `localstack.cloud` — now handled by `AI_SBX_NETWORK` and
-by automatic allowance of any host backing a provisioned secret.
+Denied, and therefore declared in `AI_SBX_NETWORK`:
+
+| Host | Needed by |
+| --- | --- |
+| `*.nuget.org` | roslyn, easy-dotnet, NuGet restore |
+| `pkgs.dev.azure.com` | Azure-hosted NuGet feeds |
+| `builds.dotnet.microsoft.com`, `dotnetcli.azureedge.net`, `dotnetbuilds.azureedge.net`, `dotnetcli.blob.core.windows.net`, `ci.dot.net` | .NET SDK downloads |
+| `registry.terraform.io` | provider downloads for terragrunt |
+| `mise.jdx.dev` | mise self-resolution |
+| `default.exp-tas.com` | Copilot feature flags |
+
+Confirmed reachable from inside the sandbox afterwards: `api.nuget.org` and
+`registry.terraform.io` both return HTTP 200.
+
+Wildcards match a single label: `*.nuget.org` covers `api.`, `www.`, `globalcdn.` and
+the bare domain, but `*.azureedge.net` does **not** reach
+`dotnetcli.blob.core.windows.net`. Prefer explicit hosts over a broad CDN wildcard —
+`*.azureedge.net` would admit every Azure CDN customer, not just Microsoft's.
+
+The work registries — `npm.fontawesome.com`, `proget.careevolution.com`,
+`localstack.cloud` — are allowed automatically, since they back provisioned secrets.
 
 ## Acceptance