[Demo][Sandboxes] Define cloud vs local execution policy matrix

## Demo goal
Support the Cloud/Local Sandboxes section with a concrete policy artifact.

## Requested change
Create `demo-app/policies/sandbox-policy.md` with:
- Allowed tools per task category
- Network access by environment (cloud/local)
- Data access boundaries (repo, secrets, external APIs)
- Example: tasks that must run local vs can run cloud

## Presenter cue
Use as the governance control-plane example during policy boundaries discussion.

Create demo-app/policies/sandbox-policy.md and start by using the requested change list as the document outline. Done means the artifact covers allowed tools by task category, cloud/local network access, repo/secrets/external API boundaries, and examples of tasks that must run locally versus those that can run in the cloud.

Written by the indexing model from the issue text.