fix: harden final v1.0.1 release gates

[Coding-Dev-Tools]

Summary

• fail closed when a configured hosted endpoint cannot be DNS-resolved for SSRF validation
• keep the grounded-recall evaluation usable from the default Windows console
• add regression coverage and release notes

Verification

• python -m pytest tests/ -q -rs
• ruff check .
• retrieval and release artifact gates completed locally

This remains a draft pending private-cloud CI, operations evidence, and authorized canaries.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0f32562b27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the cloud-session error contract on DNS failure

When a configured control or compute hostname has a transient DNS failure, this newly raised ValueError escapes callers that deliberately handle only CloudSessionError: for example, scripts/sync.py catches CloudSessionError around access_for_workspace() and will now emit a traceback instead of its documented connection error and exit code 2. Wrap this validation failure as CloudSessionError in the cloud-session boundary (or update those callers) so fail-closed validation remains a graceful operational failure.

Useful? React with 👍 / 👎.