Add DNS resolution validation in scrape executor

[bug-ops]

Parent: #624

crates/zeph-tools/src/scrape.rs:186-206 — URL host checked at parse time but DNS not validated. Resolve hostname before request and validate resolved IP. Reuse is_private_ip() from crates/zeph-a2a/src/client.rs:135-155.