fix· Sandboxes
A DNS timeout reaching the model gets one retry
On oh-my-pi runs, a `getaddrinfo ETIMEOUT` failure now resumes the same agent session once instead of failing the run.
We already did this for a dropped connection, and it still needs a saved session to resume. A second failure stops the run, and an authentication or quota error is never retried this way, even when its message mentions DNS. Claude Code runs are unchanged.
#1508