Clarify sandbox allowNetwork domain settings

[dileepyavan]

fixes #314181
This updates the setting descriptions for agent network domains and sandbox allowNetwork mode so they clearly state that allowNetwork allows all domains and denied network domains do not apply in that mode.

[github-actions]

blocks-ci screenshots changed

Replace the contents of test/componentFixtures/blocks-ci-screenshots.md with:

Updated blocks-ci-screenshots.md

<!-- auto-generated by CI — do not edit manually -->

#### editor/codeEditor/CodeEditor/Dark
![screenshot](https://hediet-screenshots.azurewebsites.net/images/cb32a3e854b5734fe5aaca2318f2e0a42ee821b05ea97883ea42c5ba95edb3c3)

#### editor/codeEditor/CodeEditor/Light
![screenshot](https://hediet-screenshots.azurewebsites.net/images/42624fbba5e0db7f32c224b5eb9c5dd3b08245697ae2e7d2a88be0d7c287129b)

#### editor/inlineChatZoneWidget/InlineChatZoneWidget/Dark
![screenshot](https://hediet-screenshots.azurewebsites.net/images/710d77ca0f3926ff2c6c53560aa81942893ffb5a50fae3f3897b6b01ecac9a45)

#### editor/inlineChatZoneWidget/InlineChatZoneWidget/Light
![screenshot](https://hediet-screenshots.azurewebsites.net/images/179accfb89a5aeac32979be1da02a9d2269cfe8b8679404c4f6015b1f5998d60)

#### editor/inlineChatZoneWidget/InlineChatZoneWidgetTerminated/Dark
![screenshot](https://hediet-screenshots.azurewebsites.net/images/2fbc12507b59ff950d9612d2df92e6b39d8bf0bf500478e42eca2ead4d1ae206)

#### editor/inlineChatZoneWidget/InlineChatZoneWidgetTerminated/Light
![screenshot](https://hediet-screenshots.azurewebsites.net/images/4632ab04d1fdd7db9ab0e00cce10aefb7a6344eb8869dfce740309a8801cab73)

[Copilot]

Pull request overview

This PR updates user-facing setting descriptions related to agent network domain filtering and the agent sandbox allowNetwork mode, and regenerates the corresponding enterprise policy catalog text so the messaging is clearer.

Changes:

• Reworded the terminal agent sandbox allowNetwork enum description to state that all network domains are allowed.
• Updated chat.agent.allowedNetworkDomains / chat.agent.deniedNetworkDomains descriptions to mention allowNetwork.
• Updated generated enterprise policy text (policyData.jsonc) to match the new setting descriptions.

Show a summary per file

File	Description
src/vs/workbench/contrib/terminalContrib/chatAgentTools/common/terminalChatAgentToolsConfiguration.ts	Updates the allowNetwork enum description for the agent sandbox setting.
src/vs/workbench/contrib/chat/browser/chat.contribution.ts	Updates the allowed/denied network domain setting descriptions to reference allowNetwork.
build/lib/policies/policyData.jsonc	Regenerated policy description strings to match the updated setting text.

Copilot's findings

Comments suppressed due to low confidence (3)

src/vs/workbench/contrib/chat/browser/chat.contribution.ts:930

• Same issue in the policy-localized copy of the description: allowNetwork does not bypass domain filtering when chat.agent.networkFilter is enabled, so “all domains are allowed”/“denied takes precedence” should be made conditional to avoid being misleading.

						value: nls.localize('chat.agent.allowedNetworkDomains', "Allowed domains for network access by agent tools (fetch tool, integrated browser). Applies when {0} or {1} is enabled. When {1} is set to {2}, all domains are allowed. Supports wildcards like {3}. When both allowed and denied lists are empty, all domains are blocked. Denied domains (see {4}) take precedence.", `\`#${AgentNetworkDomainSettingId.NetworkFilter}#\``, `\`#${AgentSandboxSettingId.AgentSandboxEnabled}#\``, `\`${AgentSandboxEnabledValue.AllowNetwork}\``, '`*.example.com`', `\`#${AgentNetworkDomainSettingId.DeniedNetworkDomains}#\``),

src/vs/workbench/contrib/chat/browser/chat.contribution.ts:936

• This says the denied domain list “does not apply” when chat.agent.sandbox.enabled is allowNetwork, but the denied list still applies whenever chat.agent.networkFilter is enabled (regardless of sandbox mode). Consider clarifying that allowNetwork only disables sandbox-driven filtering and does not affect the global chat.agent.networkFilter behavior.

			markdownDescription: nls.localize('chat.agent.deniedNetworkDomains', "Denied domains for network access by agent tools (fetch tool, integrated browser). Applies when {0} or {1} is enabled. This does not apply when {1} is set to {2}. Takes precedence over {3}. Supports wildcards like {4}.", `\`#${AgentNetworkDomainSettingId.NetworkFilter}#\``, `\`#${AgentSandboxSettingId.AgentSandboxEnabled}#\``, `\`${AgentSandboxEnabledValue.AllowNetwork}\``, `\`#${AgentNetworkDomainSettingId.AllowedNetworkDomains}#\``, '`*.example.com`'),

src/vs/workbench/contrib/chat/browser/chat.contribution.ts:948

• Same issue in the policy-localized copy: the denied list still applies when chat.agent.networkFilter is enabled, even if chat.agent.sandbox.enabled is allowNetwork. The “does not apply” wording should be made conditional to avoid incorrect guidance.

						value: nls.localize('chat.agent.deniedNetworkDomains', "Denied domains for network access by agent tools (fetch tool, integrated browser). Applies when {0} or {1} is enabled. This does not apply when {1} is set to {2}. Takes precedence over {3}. Supports wildcards like {4}.", `\`#${AgentNetworkDomainSettingId.NetworkFilter}#\``, `\`#${AgentSandboxSettingId.AgentSandboxEnabled}#\``, `\`${AgentSandboxEnabledValue.AllowNetwork}\``, `\`#${AgentNetworkDomainSettingId.AllowedNetworkDomains}#\``, '`*.example.com`'),

• Files reviewed: 3/3 changed files
• Comments generated: 1