policy: add "sandbox, no internet" preset to mock-policy-server (#333258)

Adds a managed-settings preset that enables the agent runtime sandbox with bypass allowed while denying outbound network access, so sandboxed tools run offline. Makes it easy to exercise the no-internet sandbox policy path against the local mock server.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>