web_fetch tool fails on all URLs (TypeError: fetch failed) in IPv4-only sandbox environments

### Description

The built-in `web_fetch` tool fails on **every** URL, including trivial always-up test sites (e.g. `https://example.com`), returning a generic error:

```
TypeError: fetch failed
```

This happens both with `raw: true` and default markdown mode, and regardless of the target site (tested `https://example.com` and `https://www.intel.com/...`).

### Environment

- CLI version: 1.0.68
- OS: Linux (Copilot CLI cloud/session sandbox)
- Host network: no global IPv6 address on the primary interface (`eth0` only has a link-local `fe80::/64` address; `ip -6 route show` shows no default IPv6 route)

### Steps to reproduce

1. In a Copilot CLI session, invoke the `web_fetch` tool against `https://example.com`.
2. Observe `TypeError: fetch failed` with no further detail.

### Diagnosis / evidence that this is not a general network outage

From the same session's bash shell:
- `curl https://example.com` → succeeds (`HTTP 200`)
- `curl -4 https://example.com` (IPv4 forced) → succeeds consistently
- `curl -6 https://example.com` (IPv6 forced) → fails consistently: `Failed to connect to example.com port 443 ... Couldn't connect to server`
- Plain Node `fetch()` (same Node runtime available in the sandbox, v24.13.0) → succeeds, because Node's `fetch`/undici implementation performs Happy-Eyeballs-style fallback from IPv6 to IPv4 automatically
- DNS resolves both `A` (IPv4) and `AAAA` (IPv6) records for the target domains

This strongly suggests the `web_fetch` tool's underlying HTTP client attempts the IPv6 (`AAAA`) address first (as returned by DNS) and does not fall back to IPv4 on failure, causing an immediate, opaque `TypeError: fetch failed` in environments where IPv6 egress is unavailable (no global IPv6 address/route on the host, only link-local).

I even tried disabling IPv6 system-wide on the sandbox host via `sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1` (and `default`) — `curl`/Node fetch continued to work fine afterward, but `web_fetch` still failed identically. This indicates `web_fetch` likely executes in a separate process/container from the interactive bash sandbox, so host-level network changes made from within the session don't reach it — the fix needs to happen wherever that tool's HTTP client actually runs.

### Expected behavior

`web_fetch` should successfully fetch pages in environments with IPv4-only egress, ideally by:
- Implementing Happy Eyeballs / IPv4 fallback when IPv6 connection attempts fail, and/or
- Surfacing a more actionable error message (e.g., distinguishing DNS failure vs. connection refused vs. TLS failure) instead of a generic `TypeError: fetch failed`.

### Workaround

Using `curl` via the `bash` tool as a substitute for `web_fetch` works reliably in the same session.

Start by locating the web_fetch entry point and the HTTP client process it uses; compare its behavior with Node v24.13.0 fetch/undici and the IPv4-only reproduction described here. Done means web_fetch succeeds when IPv6 egress is unavailable, or reports a more actionable network error; verify against https://example.com with IPv4-only connectivity.

Written by the indexing model from the issue text.