GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

Solid, thorough change and CI is green — but there's a runtime defect the tests don't catch. In dispatchWebhook you set fetchUrl.hostname = ip and then call fetch(). For HTTPS webhooks that breaks TLS: undici connects to the IP, uses the IP as the SNI servername, and validates the server certificate against the IP rather than the original hostname — so real HTTPS deliveries fail with ERR_TLS_CERT_ALTNAME_INVALID. The unit test mocks fetch, so it passes anyway. Correctly pinning the resolved IP while keeping TLS valid needs a raw https.request with servername set to the original hostname (SNI) plus a Host header — which is exactly what #2669 does. Closing in favor of consolidating the TOCTOU fix there. Thanks for the careful work on the call-site refactor.