/iblai-vibe-agent-virtual-machine

Add the agent Sandbox Network Access section -- "Decide what this agent's virtual machine can reach and which credentials it can use." It renders under the Sandbox Type card while Virtual Machine Shell is the selected kind, and it holds three controls plus a billing notice:

• Egress Profile — No Network (the default), Package Registries, Public Internet, Custom Allowlist.
• Network Policy — required under Custom Allowlist; a picker over the organization's policies with Create Policy, Edit Policy and Manage Policies shortcuts and the chosen policy's hosts listed below it.
• Secrets — shown under Public Internet or Custom Allowlist: a checkbox list of the organization's VM secrets (keys the VM can use but never read), capped at 20 per agent, with Manage Secrets.