TestWebhookSecret_MaskedExceptOnCreate/RejectsReservedPrefix and the
MCP HTTPHandlerDispatcher integration test create real webhooks through
the handler, which calls ValidateWebhookURL's net.LookupIP SSRF guard.
That needs DNS, which is unavailable in a sandboxed Nix build (and any
other network-less test runner). Switch to a literal public IP, same
fix already applied in handlers_webhook_token_idor_test.go.
Claude
7bb76a558d