fix(e2e): stabilize wildcard host DNS test

[drew]

Summary

Stabilize the Python e2e wildcard-host policy test by replacing the Anthropic telemetry subdomain with deterministic public sslip.io hostnames. The previous statsig.anthropic.com target can be NXDOMAIN or resolve to private ranges in CI, causing the SSRF guard to correctly return 403 before the wildcard match assertion can pass.

Related Issue

N/A

Changes

• Added shared wildcard test constants backed by 1.1.1.1.sslip.io.
• Updated host wildcard positive and negative cases to use deterministic public DNS instead of vendor telemetry DNS.
• Kept the test coverage focused on single-label wildcard matching, bare-domain rejection, and deep-subdomain rejection.

Testing

• mise run pre-commit passes
• Unit tests added/updated - not applicable; test-only e2e stabilization
• E2E tests added/updated - updated the Python e2e wildcard-host coverage, not run locally because no active OPENSHELL_GATEWAY was configured

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable) - not applicable; test-only change

[github-actions]

Label test:e2e applied for 4eb602e. Open the existing run and click Re-run all jobs to execute with the label set. The E2E Gate check on this PR will flip green automatically once the run finishes.