[SaladDay]

Fixes a batch of review findings on the sandbox network cap.

• State the E2B exceptions to the blocked-address rule in the contract (EN + zh) and in the Provider comments.
• Delete the unused setup cautions end to end: the declaration field, the generated projection, the Web confirmation dialog and its CSS and strings.
• Drop the policy artifact role from the Provider docs and remove an unused import in NetworkSettings.
• Reject a submitted network without public or domains with a 400 naming the member.
• Log only the helper's unresolved/unsupported name lines.
• Share one exact-host rule between the Environment allowed_domains check and the deployment cap, so a name such as x.1 fails at Session creation.
• Point the troubleshooting guide to Settings -> Sandbox and scheduling -> Network.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}