ExternalSandbox managed-network handling can weaken Require or downgrade to none

Observed while reviewing downstream carry of recent sandboxing changes.

Summary
The ExternalSandbox bypass path and managed-network / restrictive-policy handling need to stay fail-closed for Require semantics. If the bypass is applied too early or in the wrong shared decision point, the resulting sandbox choice can weaken Require behavior or downgrade to none.

Why this matters

• ExternalSandbox should be a deliberate bypass only where policy allows it
• Require semantics should not silently collapse to no sandbox
• transform-path coverage matters, not only initial selection