sbx: explain kit network rules on move to cloud

sbx move --to cloud now applies the sandbox's kit or agent network
rules, as sbx --cloud create does. Rules added locally still don't
transfer. Correct the move and cloud network policy pages, which said
no local rules apply.

Source: docker/sandboxes#6707 (backported as #6814)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>

content/manuals/ai/sandboxes/cloud/move.md

@@ -72,10 +72,12 @@ appear in the cloud destination. When the source has a workspace, the CLI
 warns and asks for confirmation. The `--force` flag skips the prompt but
 doesn't include those files.
 
-The destination uses cloud network policy. Local network rules don't transfer.
-If the local source has HTTP method or path restrictions, the CLI warns and
-asks for confirmation because those restrictions won't apply in the cloud.
-`--force` skips the prompt but retains the warning.
+The destination uses cloud network policy and the network rules of the
+sandbox's kit, or of its built-in agent, as `sbx --cloud create` does. Network
+rules you added locally don't transfer. If the local source has HTTP method or
+path restrictions, the CLI warns and asks for confirmation because those
+restrictions won't apply in the cloud. `--force` skips the prompt but retains
+the warning.
 
 Published TCP sandbox ports are published on the cloud destination with cloud
 URLs. Ports that the cloud refuses are skipped with a warning. Host port

content/manuals/ai/sandboxes/cloud/network-policy.md

@@ -26,7 +26,8 @@ precedence over allow rules across the applicable policies.
 Cloud creation uses cloud account policy, network rules passed to the command,
 and network access declared by the agent or kit. Both `sbx --cloud create` and
 `sbx --cloud run` leave local network and organization policies on the host.
-Moving a local sandbox to the cloud also uses cloud policy.
+Moving a local sandbox to the cloud works the same way, except that rules you
+added locally don't transfer.
 
 Define the intended policy in the cloud store. After creation, inspect the
 configured rules and [verify connection decisions](#inspect-network-policy).