[kaxil]

The sandbox configuration page was hard to use. One paragraph covered five backends' network rules in a single 30-line run of clauses, the same explanations (the sandbox lifetime, the durable and HITL refusals) appeared two or three times, and it quoted one-off measurements no reader could reproduce. It also had facts wrong.

The rewrite is organised by what a user sets up: network access, packages, sizing and timeouts, credentials, getting a file out, sharing a sandbox between tasks, what happens on failure, and cleanup. Per-backend network behaviour is now one table, and other backend differences link to backends.rst instead of being repeated in each section. Every quoted error and output block comes from a run against the current code: the refusal messages from each backend, what the model sees from a real Modal sandbox (a failed pip install, a non-zero exit, a timeout), and the task logs of the export and attach examples run with airflow dags test.

Corrections to what the old page said:

• OpenSandbox, Boat and Islo also refuse allow_egress_to_cidrs; the page said only sbx and OpenShell do. Islo was not mentioned at all.
• The run_command description does not tell the model its working directory; it tells it to run pwd.
• A run with exports that ends with no sandbox (it never called a tool, or a timeout deleted the sandbox) fails the task; it does not just export nothing.
• Errors inside the sandbox other than terminal ones go back to the model as retry prompts, not only a missing path or an oversized file.

The hand-kept SandboxToolset parameter list is removed. The API reference renders the same parameters from the docstring, and the copy had already drifted (it was missing exports).

In backends.rst, the sbx section now says SandboxSpec.env is written to /etc/profile (moved from the configuration page), and an anchor was added for "What differs between the backends" so the configuration page can link to it.

backends.rst and index.rst have the same problems as the old configuration page, and two wrong claims I left alone here to keep this diff reviewable: index.rst still says only sbx and OpenShell refuse allow_egress_to_cidrs, and the "Command timeouts" bullet in backends.rst says a timeout destroys an sbx sandbox, while sbx kills the command inside the sandbox and destroys it only when the CLI itself hangs. Those pages are a follow-up.