acq(kit-translate): caps.network.allow entries emitted unquoted — wildcard host (e.g. *.npmjs.org) yields invalid sbx spec #220

Summary

When kit_translate_to_sbx (in acq.backends/kit-translate.sh) emits the
caps.network.allow block for the synthesized sbx-v2 kit, it writes each host
unquoted:

printf '%s\n' "$hosts" | while IFS= read -r h; do
  [ -n "$h" ] && printf '      - %s\n' "$h"
done

A legitimate neutral allow entry that starts with * — e.g. a wildcard
subdomain *.npmjs.org (valid and quoted in the neutral spec as
- "*.npmjs.org") — is emitted as a bare - *.npmjs.org. YAML then parses the
leading * as an alias, so the translated spec is invalid and acq create
fails with:

invalid spec.yaml: yaml: line NN: did not find expected alphabetic or numeric character

Repro

Neutral kit with:

caps:
  network:
    allow:
      - registry.npmjs.org
      - "*.npmjs.org"

acq create → translation writes - *.npmjs.org (unquoted) → sbx rejects the
synthesized spec. (Observed with an earlier version of the openchamber kit in
GSA-TTS/agentic-coding-patterns.)

Expected

The translator should emit allow entries in a YAML-safe form. The file already
has a helper for exactly this — _kit_yaml_quote — used for displayName,
description, and single-line command tokens. Applying it to each allow host
would single-quote any value containing YAML-special characters (*, :, #,
etc.) and leave plain hostnames bare.

Impact / scope

• Any wildcard host (*.example.com) or otherwise YAML-special allow entry in a
  neutral kit currently produces an invalid sbx spec — a latent trap for kit
  authors, since the value is valid in the neutral spec.
• Low-risk fix: route the emitted host through the existing _kit_yaml_quote.
• Related: publishedPorts is also dropped in translation (separate issue).