[SaladDay]

microsandbox restore cannot turn strict hostname enforcement off (the SDK takes only the policy there), so after a resume every domain allow stopped passing HTTPS. On mx a restricted Session's follow-up Turn after suspend failed with connection_failed because the model provider is a domain allow.

Until restore can set it (upstream superradcompany/microsandbox#1954), a restored sandbox that is not public also allows the public addresses each name of Domains, PrivateDomains and Endpoints resolves to at restore, ahead of every domain allow (a domain allow that matches first would refuse the address under strict enforcement), on the same port (Endpoint) or port-less (names). Create keeps DisableStrict, now set in egressNetwork next to the reason. Limits after a resume, for every sandbox without public internet including enabled under a cap without it (environments.md, linked from the cap table and the compatibility notes, EN + zh): except over plain HTTP, a later DNS change is missed, and other sites on those addresses are reachable.

Round-3 review doc fixes in the same PR:

• The "reserved ranges never reachable" claim is removed; microsandbox treats them as public.
• A cap-listed model host is reachable like a listed domain (public or private), not only on its port.
• DNS 53 under disabled moves into the disabled definition and the compatibility notes.

Checks: GOWORK=off go vet . and the adapter network tests (new TestRestorePinsPublicAddresses). mx (helper from this branch): restricted example.com and disabled Sessions suspend and resume (node log: suspend and resume with no error); after resume the Turns complete, example.com 200 under restricted, example.org refused, disabled refuses example.com, unlisted intranet and metadata closed.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}