fix(web-fetch): allow RFC 2544 benchmark range for fake-ip proxy compatibility

When using proxy software with fake-ip mode (like Clash), DNS resolves
to 198.18.0.0/15 range which is blocked by SSRF guard. This adds
allowRfc2544BenchmarkRange policy to web_fetch to support these users.

src/agents/tools/web-fetch.ts

@@ -527,6 +527,9 @@ async function runWebFetch(params: WebFetchRuntimeParams): Promise<Record<string
       url: params.url,
       maxRedirects: params.maxRedirects,
       timeoutSeconds: params.timeoutSeconds,
+      policy: {
+        allowRfc2544BenchmarkRange: true,
+      },
       init: {
         headers: {
           Accept: "text/markdown, text/html;q=0.9, */*;q=0.1",