Split a multi-line AI_SBX_NETWORK correctly

A long host list is naturally written as a multi-line TOML string, but read
stops at the first newline, so only the first host was ever allowed. The rest
failed later as connection errors with nothing pointing back at the list.

Newlines and carriage returns are now flattened alongside commas before
splitting, and the test covers a multi-line value; it fails without the fix.

Also records the measured host requirements for a full Neovim configuration.
The Balanced policy already permits github, npm, pypi, crates, go, ubuntu,
nodejs, hashicorp releases, Copilot and the LLM APIs, which covers 93 lazy.nvim
plugins, both mason registries and all 55 mason packages. Only the .NET and
Terraform registries need declaring.

tests/network-policy.test.sh

@@ -30,6 +30,14 @@ for host in a.example.com b.example.com c.example.com; do
         fail "install_sandbox_network skipped $host (comma and space must both split)"
 done
 
+allowed=""
+DEFAULT_NETWORK="$(printf '*.nuget.org,\nregistry.terraform.io,\nmise.jdx.dev')" \
+    install_sandbox_network >/dev/null
+for host in '*.nuget.org' registry.terraform.io mise.jdx.dev; do
+    [[ "$allowed" == *"$host"* ]] ||
+        fail "multi-line AI_SBX_NETWORK dropped $host"
+done
+
 allowed=""
 DEFAULT_NETWORK="" install_sandbox_network >/dev/null
 [[ -z "${allowed// /}" ]] ||