fix(nix): skip DNS-dependent webhook validation subtests in checkPhase

ValidateWebhookURL does a real net.LookupIP as an SSRF guard, and four
TestValidateWebhookURL subtests exercise that path against example.com.
That works fine in CI (real network) but fails under a properly
sandboxed Nix build (no network), which is what real users hit. Skip
just those subtests; the rest of the package's tests (invalid schemes,
private-IP rejection, etc.) need no network and keep running.

nix/package.nix

@@ -74,7 +74,12 @@ buildGoModule {
     # for tests, since some (e.g. invocation_framing_test.go) locate the
     # repo root via runtime.Caller.
     export GOFLAGS=''${GOFLAGS//-trimpath/}
-    go test ./...
+    # ValidateWebhookURL does a real net.LookupIP as an SSRF guard;
+    # these four subtests exercise that path against example.com, which
+    # needs DNS/network the Nix build sandbox deliberately doesn't have.
+    # Everything else in the package (invalid schemes, private-IP
+    # rejection, etc.) needs no network and still runs.
+    go test -skip 'TestValidateWebhookURL/valid_(https|http|with_port|with_path)$' ./...
     runHook postCheck
   '';