T5 — Surface unsupported networkAccess draft state

[VolkerChristian]

Summary

• surface unsupported external networkAccess values explicitly in UpcomingTurnDock
• keep those values read-only and preserve the canonical value when returning to the canonical access policy
• retain existing supported and inherent full-access behavior

Runtime proof

• CodexUIPhase1ThreadTurnUxTest builds and passes with QT_QPA_PLATFORM=offscreen
• supported workspace/read-only/external and full-access paths remain unchanged
• unsupported external values render as Unsupported (<value>), are disabled, and remain omitted from untouched drafts
• toggling access back to the canonical external policy restores the unsupported canonical value rather than normalizing it

Call-site audit

Reviewed all refreshNetworkControl, networkKey, and applyNetworkChoice call sites. Draft construction and both refresh entry points remain confined to UpcomingTurnDock; no caller or submission behavior changed.

Deletion census

• 1 file changed
• 32 insertions, 7 deletions
• no files, settings, or tests deleted

Scope

No AISuite, protocol/schema, sandbox semantics, T6 tests, paging, budgets, or unrelated UI changes.