fix(network-proxy): fail closed on network-proxy DNS lookup errors

[viyatb-oai]

Summary

Fail closed when the network proxy's local/private IP pre-check hits a DNS lookup error or timeout, instead of treating the hostname as public and allowing the request.

Root cause

host_resolves_to_non_public_ip() returned false on resolver failure, which created a fail-open path in the allow_local_binding = false boundary. The eventual connect path performs its own DNS resolution later, so a transient pre-check failure is not evidence that the destination is public.

Changes

• Treat DNS lookup errors/timeouts as local/private for blocking purposes
• Add a regression test for an allowlisted hostname that fails DNS resolution

Validation

• cargo test -p codex-network-proxy
• cargo clippy -p codex-network-proxy --all-targets -- -D warnings
• just fmt
• just argument-comment-lint

[rreichel3-oai]

LGTM!