Add ZT-NET fail-open gates for private app connectors

[zeroknowledge0x]

Following the issue-first policy (referenced in #2766).

Adds zero-trust assessment gates ZT-NET-12 through ZT-NET-16 for private app connector fail-open scenarios:

• Fail-closed behavior verification
• Policy sync enforcement
• DNS enforcement
• Bypass governance
• Direct route testing
• Audit trail

Branch ready: feat/private-app-connector-failopen-gates on zeroknowledge0x/SecuritySkills
Addresses upstream request #2744.

cc @UnitOneAI/maintainers — please review and add the approved label so the matching PR can be reopened.