Clarify sandbox usage and workflow docs

content/guides/claude-code-sandbox-model-runner.md

@@ -88,7 +88,7 @@ $ sbx policy allow network localhost:12434
 ```
 
 For background on host access from sandboxes, see
-[Accessing host services from a sandbox](../manuals/ai/sandboxes/usage.md#accessing-host-services-from-a-sandbox).
+[Accessing host services from a sandbox](../manuals/ai/sandboxes/workflows.md#accessing-host-services-from-a-sandbox).
 
 ## Step 3: Create a Claude Code sandbox
 

content/manuals/ai/sandboxes/_index.md

@@ -68,7 +68,7 @@ $ sbx run claude
 ```
 
 See the [get started guide](get-started.md) for a full walkthrough, or jump to
-the [usage guide](usage.md) for common patterns.
+the [usage guide](usage.md) for basic commands.
 
 ## Learn more
 

content/manuals/ai/sandboxes/agents/claude-code.md

@@ -38,7 +38,7 @@ Claude Code requires either an Anthropic API key or a Claude subscription.
 $ sbx secret set -g anthropic
 ```
 
-**Claude subscription**: If no API key is set, use the `/login` command inside 
+**Claude subscription**: If no API key is set, use the `/login` command inside
 Claude Code to authenticate via OAuth.
 
 ## Configuration
@@ -75,7 +75,7 @@ for available options.
 
 Claude Code's [agents view](https://code.claude.com/docs/en/agent-view)
 dispatches tasks to subagents that work in parallel, each in its own
-Git worktree. Pair it with [clone mode](../usage.md#clone-mode) for an
+Git worktree. Pair it with [clone mode](../workflows.md#clone-mode) for an
 isolated multi-agent workflow:
 
 ```console
@@ -102,7 +102,7 @@ $ git fetch sandbox-<sandbox-name>
 $ git diff main..sandbox-<sandbox-name>/<branch>
 ```
 
-See [Git workflow](../usage.md#git-workflow) for clone-mode details.
+See [Git workflows](../workflows.md#git-workflows) for clone-mode details.
 
 ## Base image
 

content/manuals/ai/sandboxes/get-started.md

@@ -173,7 +173,7 @@ my-sandbox    claude   running           ~/my-project
 ```
 
 Each row shows a sandbox's name, the agent running in it, its status, any
-[published ports](usage.md#accessing-services-in-the-sandbox), and its
+[published ports](usage.md#publish-ports), and its
 workspace — the host directory shared into the sandbox. That workspace is the
 one part of your machine the agent can see.
 
@@ -251,14 +251,13 @@ rules from one place.
 
 Then explore:
 
-- [Clone mode](usage.md#clone-mode) — give each agent an isolated Git clone
-  instead of your working tree, so you can run several agents on one repository
-  in parallel and review each one's commits separately.
+- [Usage guide](usage.md) — basic commands, reconnecting, workspaces, and port
+  publishing.
+- [Workflow patterns](workflows.md) — Git strategies, local services, CI, and
+  authenticated tools.
 - [Customize with kits](customize/) — package an agent, its tools, and its
   network rules into a reusable definition you launch with a single flag.
 - [Agents](agents/) — the full list of supported agents and how to configure
   each one.
 - [Governance](governance/) — centrally manage network and filesystem policies
   across a team.
-- [Usage guide](usage.md) — reconnecting, multiple workspaces, port forwarding,
-  and more.

content/manuals/ai/sandboxes/security/isolation.md

@@ -97,7 +97,7 @@ workspace with it:
   the VM and the agent works on a private clone inside the VM. The
   agent's edits never reach your host until you fetch them.
 
-See [Git workflow](../usage.md#git-workflow) for the workflow side of
+See [Git workflows](../workflows.md#git-workflows) for the workflow side of
 each.
 
 ### Direct mount (default)

content/manuals/ai/sandboxes/troubleshooting.md

@@ -103,7 +103,7 @@ $ git clone https://github.com/owner/repo.git
 
 If a request to `127.0.0.1` or a local network IP returns "connection refused"
 from inside a sandbox, the address is not reachable from within the sandbox VM.
-See [Accessing host services from a sandbox](usage.md#accessing-host-services-from-a-sandbox).
+See [Accessing host services from a sandbox](workflows.md#accessing-host-services-from-a-sandbox).
 
 ## Docker authentication failure