AWS Bedrock AgentCore: VPC Mode Still Leaks DNS After Unit 42 Disclosure

I lab-tested all three AWS Bedrock AgentCore network modes after Unit 42's April 7 disclosure. SANDBOX now isolated, VPC mode still leaks DNS - fix inside.