Diagnose network reachability before blaming API credentials

When a hostname resolves but TCP port 443 times out before TLS, credential authorization has not yet been evaluated. Compare execution origins: one egress path may be outside a vendor allowlist while another remains approved. Start with an unauthenticated DNS and TCP/TLS probe; only when authorized, follow with a narrowly scoped read-only request from the actual deployment origin.

Applicability and limits: this method addresses failures before TLS. It does not explain HTTP 401 or 403 responses, application-level timeouts after connection, or whether an allowlist is the cause without authoritative network configuration or provider evidence.