fix(sse): pin DNS on the three public-only image fetch sites (#13883) (#14032)

Merged via /merge-batch (2026-09-19) on top of the current `release/v3.8.51` tip.

**Reconciled before landing:** the train-3 ejection from 2026-09-18 (`tests/unit/image-generation-route.test.ts` → promptless topaz request came back 502 because `pinDns: true` bypassed the test's mocked `globalThis.fetch`) is fixed in `5fafc490` by registering the same `setPinnedFetchTestOverride()` seam the other four image tests already use, cleared in `resetStorage()`/`after`. Production keeps pinning for real.

**Evidence on the merged tree:** `image-generation-route.test.ts` 25/25; all 18 image-path test files that mock `globalThis.fetch` (handler, upscale, fal, nanobanana, agnes, alibaba, bailian, kie, magnific, minimax, pollinations, qwen, edits-multipart, fetch-timeout, route-auth, pindns-toctou-13883) 183/183; `typecheck:core` clean; `check:open-sse-typecheck` 0 errors; file-size, changelog-integrity, complexity and cognitive-complexity gates OK.

Closes #13883

src/shared/network/remoteImageFetch.ts

@@ -146,6 +146,16 @@ async function readResponseBuffer(response: Response, maxBytes: number) {
   return Buffer.concat(chunks, totalBytes);
 }
 
+// #13883: test-only escape hatch for `pinDns: true` callers that have no `fetchImpl` seam
+// of their own (imageGeneration.ts / imageUpscale/shared.ts). `createPinnedFetch` opens a
+// real undici connection, bypassing a test's monkeypatched `globalThis.fetch`; setting this
+// override lets such a test keep exercising its mock instead of a real network attempt.
+// Production callers never call the setter, so `pinDns` still pins for real in production.
+let pinnedFetchTestOverride: typeof fetch | undefined;
+export function setPinnedFetchTestOverride(fetchImpl: typeof fetch | undefined): void {
+  pinnedFetchTestOverride = fetchImpl;
+}
+
 export async function fetchRemoteMedia(
   input: string | URL,
   options: RemoteMediaFetchOptions = {}
@@ -171,6 +181,7 @@ export async function fetchRemoteMedia(
     const addresses = await assertHostnameResolvesPublic(currentUrl, guard, lookup);
     const fetchImpl =
       injectedFetch ??
+      pinnedFetchTestOverride ??
       (pinDns && addresses.length
         ? createPinnedFetch(addresses[0].address, addresses[0].family)
         : fetch);