WebFetch reports rate-limited domain checks and applies read_file rules to artifacts

What

WebFetch is the tool Claude uses to read a web page. Before fetching, it checks whether the domain is safe.

• When that check is refused for too many requests (HTTP 429), the error code is now ERATELIMIT_PREFLIGHT and the message says the domain "is temporarily rate-limited (too many domain checks from this network)". Before, it was the generic "Unable to verify if domain" message.
• Fetch failures are now sorted into kinds. Proxy problems: transport, bad response, rate limited, unavailable, rejected. Problems with the target: invalid_input, url_not_allowed and others.
• Fetching an artifact link now also checks permission rules for the read_file action, using the artifact's file path. Before, only the read action was checked.

Why

If you hit the rate limit, the message now says the domain check was rate-limited instead of looking like a network fault. Rules that deny or ask before reading files now also apply when Claude fetches an artifact link.