Pin cloud callback connections against DNS rebinding

[groupthinking]

Harden the Cloud Task callback dispatcher to fail closed for mixed public/private DNS, preventing SSRF via DNS rebinding and related log injection.

[linear-code]

GRV-531

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.