/iblai-vibe-virtual-machine

Add the organization settings Virtual Machine tab -- "Manage the network policies and secrets available to agents' virtual machines." Agents on the Virtual Machine Shell sandbox kind run each chat in an isolated Linux VM with no network access by default. This surface holds the two organization-wide records that open it up, in two sub-tabs:

• Network Policies — reusable named lists of the host:port destinations a VM may reach (up to 100 entries each).
• Secrets — keys the VM can use but never read. Inside the machine the environment variable holds a placeholder; the real value is substituted only on TLS requests to the secret's allowed hosts.

Both are shared by every agent in the organization. Picking them for one agent happens in its Sandbox settings — see /iblai-vibe-agent-virtual-machine.