fix flaky gateway tests in CI

What:
- resolve shell from PATH in bash-tools tests (avoid /bin/bash dependency)
- mock DNS for web-fetch SSRF tests (no real network)
- stub a2ui bundle in canvas-host server test when missing

Why:
- keep gateway test suite deterministic on Nix/Garnix Linux

Tests:
- not run locally (known missing deps in unit test run)

src/agents/tools/web-fetch.ssrf.test.ts

@@ -1,10 +1,9 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import * as ssrf from "../../infra/net/ssrf.js";
 
 const lookupMock = vi.fn();
-
-vi.mock("node:dns/promises", () => ({
-  lookup: lookupMock,
-}));
+const resolvePinnedHostname = ssrf.resolvePinnedHostname;
 
 function makeHeaders(map: Record<string, string>): { get: (key: string) => string | null } {
   return {
@@ -33,6 +32,12 @@ function textResponse(body: string): Response {
 describe("web_fetch SSRF protection", () => {
   const priorFetch = global.fetch;
 
+  beforeEach(() => {
+    vi.spyOn(ssrf, "resolvePinnedHostname").mockImplementation((hostname) =>
+      resolvePinnedHostname(hostname, lookupMock),
+    );
+  });
+
   afterEach(() => {
     // @ts-expect-error restore
     global.fetch = priorFetch;