review network() root constructor naming and add to spec

[eliothedeman]

Follow-up from #444.

A network() root constructor was added to the unified policy/sandbox DSL during the migration of bundled ecosystem files (examples/rust-dev.star, python-dev.star, node-dev.star, git-ssh-protected.star). It exists because expressing "allow all network traffic" in the new tree shape required a typed constructor at the root that wasn't otherwise reachable — domain(...) is per-domain and localhost(...) is per-port.

Current usage

sandbox("rust-dev", {
    path("$PWD"): allow("rwc"),
    network(): allow(),
}, doc="...")

Concerns

1. Naming asymmetry. Other root constructors are scoped (domain("github.com"), localhost(8080)); network() is the catch-all but reads as if it should take an argument.
2. Discoverability. network() doesn't appear in the spec's enumerated constructor list — it was a mechanically-required addition. The spec needs updating once the naming is settled.
3. Alternatives to consider:
   • network() (current) — fine but bare
   • domain("*") — reuses existing constructor, but * as a wildcard sentinel is implicit
   • internet() — clearer "wide open" intent, but a weird word
   • any_host() / any_domain() — explicit
   • Make it implicit: omit any network key and have default() cover it

Acceptance

• Decide on the constructor name (or remove and use a different mechanism)
• Update examples/*.star to match
• Add the constructor to the spec's enumerated list