On platforms without a local process sandbox (e.g. Windows), the local
permission matrix collapses into a single access-mode dropdown. The
'File access only' and 'Unrestricted access' options previously shared
the same host-scope subtitle, making them look identical. Give each
mode its own hint that spells out whether Shell/Python execution and
network access are allowed.