Function restricts_network_mode 

pub fn restricts_network_mode(stack: &Stack, targets_kubernetes: bool) -> bool

Whether the artifact being rendered restricts which network modes it accepts.

A sandbox is not emitted on a Kubernetes target, so nothing there routes egress through a connector and the default network stays a working answer. Every site that withholds the mode, explains the restriction, or renders a branch for it has to ask this one question — asking the stack directly is how they came to disagree.