sec(env): refuse to start master API with footgun public-binding config

Add validate_public_binding() called from the master API lifespan: when
DECNET_API_HOST is non-loopback, refuse to start if DECNET_CORS_ORIGINS
still contains a loopback origin (catches the "operator flipped to
0.0.0.0 to make it work and forgot to update CORS" footgun) or if
DECNET_CANARY_HTTP_BASE is plaintext http:// to a non-loopback host.
Log CRITICAL when DECNET_LIMITER_ENABLED=false on a public binding.
The validator no-ops under pytest so unrelated suites don't trip on it.

Add DECNET_VERIFY_HOSTNAME env knob; AgentClient and UpdaterClient
consult it when verify_hostname is None, giving production deploys
TLS hostname verification on top of the existing CA + fingerprint pin.
Default off so dev enrollments with mismatched SANs keep working.

decnet/swarm/client.py

@@ -106,15 +106,20 @@ class AgentClient:
         address: Optional[str] = None,
         agent_port: Optional[int] = None,
         identity: Optional[MasterIdentity] = None,
-        verify_hostname: bool = False,
+        verify_hostname: Optional[bool] = None,
     ):
         """Either pass a SwarmHost dict, or explicit address/port.
 
-        ``verify_hostname`` stays False by default because the worker's
-        cert SAN is populated from the operator-supplied address list, not
-        from modern TLS hostname-verification semantics.  The mTLS client
-        cert + CA pinning are what authenticate the peer.
+        ``verify_hostname`` defers to ``DECNET_VERIFY_HOSTNAME`` when the
+        caller doesn't pass an explicit value — production deploys flip
+        the env var on so the worker's cert SAN must match the address
+        the master connects to, on top of the existing CA + fingerprint
+        pin. Defaults to False so dev/test enrollments with mismatched
+        SANs keep working unchanged.
         """
+        if verify_hostname is None:
+            from decnet.env import DECNET_VERIFY_HOSTNAME
+            verify_hostname = DECNET_VERIFY_HOSTNAME
         if host is not None:
             self._address = host["address"]
             self._port = int(host.get("agent_port") or 8765)