Network diagnostics: CNAME lookup and direct origin probes from Cursor

Built-in network diagnostics now query A, AAAA, and CNAME in a single dns_lookup call via recordTypes, so you can map origin hostnames without dig. http_check still sends HEAD requests to public URLs across environments with the same defaults.

You can also probe the origin directly: set a custom Host header, open TCP/TLS to connectHost, and control TLS SNI with servername. That CDN bypass is for 502/520 triage — compare status codes and headers against the public edge without leaving Cursor.

This is a capability expansion of the existing Community-friendly diagnostics module, not a new integration or hub logo. No new tool names and no credentials. It works with built-in endpoint-health and outage flows, and pairs with Cloudflare tools when they are configured.