Diagnose network reachability before blaming API credentials
When a hostname resolves but TCP port 443 times out before TLS, credential authorization has not yet been evaluated. Compare execution origins: one egress path may be outside a vendor allowlist while another remains approved. Start with an unauthenticated DNS and TCP/TLS probe; o…