Split a multi-line AI_SBX_NETWORK correctly

A long host list is naturally written as a multi-line TOML string, but read
stops at the first newline, so only the first host was ever allowed. The rest
failed later as connection errors with nothing pointing back at the list.

Newlines and carriage returns are now flattened alongside commas before
splitting, and the test covers a multi-line value; it fails without the fix.

Also records the measured host requirements for a full Neovim configuration.
The Balanced policy already permits github, npm, pypi, crates, go, ubuntu,
nodejs, hashicorp releases, Copilot and the LLM APIs, which covers 93 lazy.nvim
plugins, both mason registries and all 55 mason packages. Only the .NET and
Terraform registries need declaring.

tasks/ai/sbx

@@ -806,8 +806,14 @@ allow_sandbox_host() {
 install_sandbox_network() {
     [[ -n "$DEFAULT_NETWORK" ]] || return 0
 
+    # A multi-line TOML string is a natural way to write a long list, and read
+    # stops at the first newline, so separators are flattened before splitting.
+    local normalized="${DEFAULT_NETWORK//,/ }"
+    normalized="${normalized//$'\n'/ }"
+    normalized="${normalized//$'\r'/ }"
+
     local -a allow_hosts
-    read -r -a allow_hosts <<<"${DEFAULT_NETWORK//,/ }"
+    read -r -a allow_hosts <<<"$normalized"
 
     ((${#allow_hosts[@]})) || return 0