fix(security): bound hosted Addie auth probes

[bokelley]

Summary

• remove hosted Addie escape hatches for HTTP/private targets and live-side-effect signing vectors
• enforce credential-free public HTTPS targets and use the DNS-pinned SSRF-safe fetch path for capability probes
• always skip replay and rate-abuse live vectors, regardless of the bundled sandbox contract
• bound signing-grader child processes with stable caller identities, distributed rate caps, and a fail-fast two-process semaphore
• regenerate the Addie tool reference and add adversarial regression coverage

Root cause

Both hosted auth-grader tools exposed allow_http, which mapped directly to the SDK/CLI private-network override. The signing grader also allowed callers to request live vectors and had no cross-request process bound; ordinary authenticated users could launch multiple long-lived child processes. Its custom capability probe preflight-resolved DNS and then used global fetch, leaving a DNS-rebinding gap.

Impact

Hosted Addie now probes only public HTTPS agents. Trusted private development loops and explicit live-vector testing remain available through the local SDK CLI. Signing grades are capped at two concurrent children per server, with per-user and service-wide limits; excess work fails fast with a retry message.

Validation

• final security expert review: clean
• final testing expert review: clean
• focused security/unit suites: 161/161 passed independently; 134/134 passed after rebase
• TypeScript no-emit: passed
• generated Addie tool reference check: passed (247 tools, 15 sets)
• Semgrep: 0 findings across 210 rules on changed runtime files
• diff/package/lock/dist scope checks: passed

No changeset is required because this is an operational Addie/server security fix with no protocol-package API change.