docs(policy): list the teams preset in the Open tier table (#9504)

## Summary

The Policy Tiers table in `docs/reference/network-policies.mdx` did not
list the `teams` preset in its Open
row, while the `open` tier in `nemoclaw-blueprint/policies/tiers.yaml`
has applied that preset since commit
`17d03317b` (#5585). An operator who read this table before selecting
Open was not told that the tier opens
Microsoft Teams egress by default. The Open row now names `teams` in the
position it occupies in
`tiers.yaml`, with the experimental tag that
`docs/reference/platform-support.mdx` records for the channel.

## Related Issue

Fixes #9503

This repeats a correction the project already accepted. Issue #3688
reported the identical drift for
`wechat`, and PR #4276 (commit `a5768a244`) corrected the same row the
same way. PR #5585 added `teams` to
the `open` tier and stated that it would "Leave user-facing
documentation to a follow-up docs-owner change";
that follow-up did not reach this page.

## Changes

- `docs/reference/network-policies.mdx`: add `` `teams` (experimental)
`` to the Open row of the Policy
Tiers table, between `whatsapp` and `jira`, matching the preset order in
  `nemoclaw-blueprint/policies/tiers.yaml`.

One existing table row changed. Net line delta is ±0 (1 insertion, 1
deletion, one file). No new
abstraction, configuration, fallback, migration, or compatibility path.

Checked and unchanged: the Restricted, Balanced, and Personal rows
already match `tiers.yaml`, so `teams`
is the table's only omission.

Not changed, and offered here instead: the `<AgentOnly
variant="openclaw">` note earlier on the same page
says "The baseline policy does not include messaging endpoints for
Telegram, Discord, Slack, WeChat, or
WhatsApp." That sentence omits Microsoft Teams and also Google Chat.
Google Chat is not a tier preset, so
that sentence belongs to a different premise than this tier-table drift,
and adding only Teams would leave
a new partial list. Say the word and I will extend that note in this PR
or a separate one.

## Type of Change

- [ ] Code change (feature, bug fix, or refactor)
- [ ] Code change with doc updates
- [x] Doc only (prose changes, no code sample modifications)
- [ ] Doc only (includes code sample changes)

## Quality Gates

- [ ] Tests added or updated for changed behavior
- [ ] Existing tests cover changed behavior — justification:
- [x] Tests not applicable — justification: the change is one
documentation table cell and alters no
executable behavior. `npm run docs` is the validation for this page. If
you want a guard against the next
recurrence, the natural home is the existing tier-loader test surface
for `src/lib/policy/tiers.ts`: one
case that reads `resolveTierPresets("open")` and asserts each preset
name appears in the Open row of
`docs/reference/network-policies.mdx`. That adds lines, so I left it out
of this ±0 change and will add it
  in this PR if you prefer it here.
- [ ] Sensitive paths changed (security, policy, credentials, preflight,
onboarding, inference, runner, sandbox, or messaging)
- [ ] Sensitive-path review completed or maintainer-approved waiver
recorded — reviewer/approval link/justification:
- [ ] Non-success, skipped, or missing CI check accepted by maintainer —
check name, approval link, and follow-up issue:

## Documentation Writer Review

- [x] Documentation writer subagent reviewed the completed changes
- Result: `docs-updated`
- Evidence: Updated docs/reference/network-policies.mdx. The writing
rules and documentation style were reviewed.
- Agent: Pi CLI
<!-- docs-review-head-sha: 0473cf7 -->
<!-- docs-review-agents-blob-sha:
993bdd8 -->
## Verification

- [x] PR description includes a `Signed-off-by:` line and every commit
appears as `Verified` in GitHub
- [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or
`npm run validate:pr` passed after refreshing `origin/main` when hooks
were skipped or unavailable — `npm run validate:pr` passed after
refreshing `origin/main` and rebasing onto the current `main`
- [x] Targeted behavior tests pass for the current change set, or tests
are marked not applicable above — marked not applicable above; `npm run
docs` exits 0
- [ ] Applicable broad gate passed — `npm test` for broad
runtime/test-harness changes; `npm run check` for repo-wide
validation/coverage changes — command/result:
- [x] Quality Gates section completed with required justifications or
waivers
- [x] No secrets, API keys, or credentials committed
- [x] `npm run docs` builds without warnings (doc changes only) — 0
errors. The two reported warnings are
the unauthenticated Fern redirects check and the site accent-color
contrast ratio; both appear identically
  on an unmodified checkout of this page.
- [x] Doc pages follow the [style
guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md)
(doc changes only)
- [ ] New doc pages include SPDX header and frontmatter (new pages only)

---
Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com>


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Documentation**
* Updated network policy reference documentation to include the
experimental `teams` preset in the Open policy tier.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com>

Author: udsy19

docs/reference/network-policies.mdx

@@ -138,7 +138,7 @@ This is the supported registry-backed way to replay a live exact-key removal dur
 |------|------------------|-------------|
 | Restricted | No tier defaults | Starts from the baseline policy. Web search or messaging integrations selected earlier can still suggest their required presets; deselect them during policy review for baseline-only access. Restricted suppresses other agent-required additions; reapply them later with `policy add` only after reviewing the additional egress. |
 | Balanced (default) | `npm`, `pypi`, `huggingface`, `brew`, selected `brave` or `tavily` web search preset | Full dev tooling and web search when you select a provider the active agent supports. No messaging platform access. Apply the `weather` preset explicitly if your agent needs read-only weather lookups. |
-| Open | `npm`, `pypi`, `huggingface`, `brew`, selected `brave` or `tavily` web search preset, `weather`, `public-reference`, `slack`, `discord`, `telegram`, `wechat` (experimental), `whatsapp` (experimental), `jira`, `outlook` | Broad access across third-party services including messaging, productivity, weather, and public-reference APIs. |
+| Open | `npm`, `pypi`, `huggingface`, `brew`, selected `brave` or `tavily` web search preset, `weather`, `public-reference`, `slack`, `discord`, `telegram`, `wechat` (experimental), `whatsapp` (experimental), `teams` (experimental), `jira`, `outlook` | Broad access across third-party services including messaging, productivity, weather, and public-reference APIs. |
 | Personal | `personal-open-internet` (mandatory) | Lets every sandbox binary open TCP connections to public and private address ranges on destination ports `80` and `443`. The broad route replaces overlapping web endpoints while preserving non-web policy. Unspecified, loopback, and link-local ranges remain blocked. |
 
 When Personal is selected or carried forward, the `personal-open-internet` preset is mandatory for every agent and every onboarding entry point.