sbx: document OS-specific filesystem rule paths

Filesystem rule examples only showed POSIX paths and never explained that
rules match the path format of the developer's OS. Add Windows drive-letter
and backslash syntax (including the *: any-drive wildcard), note WSL support,
and call out that a multi-platform policy needs a rule per path format.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: dvdksn

content/manuals/ai/sandboxes/governance/concepts.md

@@ -78,18 +78,40 @@ Both IPv4 and IPv6 notation are supported: `10.0.0.0/8`, `192.168.1.0/24`,
 ### Filesystem rules
 
 Filesystem rules use the actions `read` and `write`. Resources are host paths
-that sandboxes can mount as workspaces.
+that sandboxes can mount as workspaces. Write each path in the format used by
+the member's operating system. A rule only applies to members whose machines
+use that format, so cover every platform your members use.
+
+**Path formats**
+
+| Operating system | Example path                              | Home directory rule                       |
+| ---------------- | ----------------------------------------- | ----------------------------------------- |
+| macOS            | `/Users/<name>/projects/**`               | `~/**`                                    |
+| Linux            | `/home/<name>/projects/**`                | `~/**`                                    |
+| Windows          | `C:\Users\<name>\projects\**`             | `*:\Users\**`                             |
+| WSL              | `\\wsl.localhost\<distro>\home\<name>\**` | `\\wsl.localhost\<distro>\home\<name>\**` |
+
+On macOS and Linux, `~` expands to the member's home directory, so `~/**`
+matches each member's home tree without naming the user. Windows has no `~`
+shorthand: use `*` for the segments that vary between members, where `*:`
+matches any drive letter. So `*:\Users\**` matches any user's home directory on
+any drive. WSL paths are reached from the Windows host through the
+`\\wsl.localhost\<distro>` share. To allow a location for members on more than
+one platform, add a separate rule for each format.
+
+**Wildcards**
+
+Wildcards behave the same way in every path format:
 
 | Pattern            | Example    | Matches                                                    |
 | ------------------ | ---------- | ---------------------------------------------------------- |
 | Exact path         | `/data`    | `/data` only                                               |
 | Segment wildcard   | `/data/*`  | `/data/project`, one path segment only, not subdirectories |
 | Recursive wildcard | `/data/**` | `/data/project`, `/data/project/src`, any depth            |
 
-Use `**` when you intend to match a directory tree recursively. A single `*`
-only matches within one path segment and won't cross directory boundaries.
-For example, `~/**` matches all paths under the home directory, while `~/*`
-matches only direct children of `~`.
+Use `**` to match a directory tree recursively. A single `*` matches within one
+path segment and won't cross a path separator. For example, `~/**` matches all
+paths under the home directory, while `~/*` matches only its direct children.
 
 ## Rule evaluation