#23805: Sandbox: default browser network to none and fail bridge without source range

## Summary - change sandbox browser default network to `none` (default-deny baseline) - fail config validation when `sandbox.browser.network="bridge"` is set without `sandbox.browser.cdpSourceRange` - keep explicit custom/bridge network support when source restriction is provided - add regression tests for the new default and bridge validation behavior ## Why This prevents insecure browser-network drift and enforces explicit CDP source restriction whenever bridge mode is used. ## Tests - `pnpm vitest run src/config/config.sandbox-docker.test.ts src/agents/sandbox-agent-config.agent-specific-sandbox-config.test.ts src/agents/sandbox/config-hash.test.ts` - `pnpm lint` <!-- greptile_comment --> <h3>Greptile Summary</h3> Changed sandbox browser default network from `openclaw-sandbox-browser` to `none` for a default-deny security baseline, and added validation requiring `sandbox.browser.cdpSourceRange` when using bridge mode. - Changed default browser network to `"none"` in `resolveSandboxBrowserConfig` - Added Zod validation that rejects `network: "bridge"` without `cdpSourceRange` - Updated documentation strings and help text to reflect the new defaults - Added comprehensive test coverage for the bridge validation rules - **Critical bug**: Line 34 in `src/agents/sandbox/config.ts` still references `DEFAULT_SANDBOX_BROWSER_NETWORK` which was removed from imports, causing a ReferenceError <h3>Confidence Score: 1/5</h3> - This PR has a critical runtime error that will break browser sandbox functionality - The PR removes `DEFAULT_SANDBOX_BROWSER_NETWORK` from imports in `src/agents/sandbox/config.ts` but the constant is still referenced on line 34, which will cause a ReferenceError at runtime whenever `resolveSandboxBrowserDockerCreateConfig` is called with an empty browser network string. The security improvements are sound, but this bug must be fixed before merge. - Pay close attention to `src/agents/sandbox/config.ts` line 34 - contains undefined reference that will cause runtime error _{Last reviewed commit: b92af71} <!-- greptile_other_comments_section --> <!-- /greptile_comment -->