fix: allow RFC 2544 benchmark range in trusted SSRF policy

Add allowRfc2544BenchmarkRange: true to WEB_TOOLS_TRUSTED_NETWORK_SSRF_POLICY
to fix web_fetch being blocked when using Clash fake-ip mode (198.18.0.0/15).

This only affects withTrustedWebToolsEndpoint, keeping strict SSRF
behavior for withStrictWebToolsEndpoint (citation redirect resolution).

src/agents/tools/web-guarded-fetch.ts

@@ -7,6 +7,7 @@ import type { SsrFPolicy } from "../../infra/net/ssrf.js";
 
 const WEB_TOOLS_TRUSTED_NETWORK_SSRF_POLICY: SsrFPolicy = {
   dangerouslyAllowPrivateNetwork: true,
+  allowRfc2544BenchmarkRange: true,
 };
 
 type WebToolGuardedFetchOptions = Omit<GuardedFetchOptions, "proxy"> & {