Use private host transport in containerized CI

.github/workflows/candidate.yml

@@ -298,6 +298,13 @@ jobs:
           actual_client_sha="$(git -C ruby-client rev-parse HEAD)"
           test "$actual_client_sha" = "$EXPECTED_CLIENT_SHA"
           echo "value=$actual_client_sha" >> "$GITHUB_OUTPUT"
+      - name: Resolve the private Docker host transport
+        run: |
+          probe_host="$(ip -4 route show default | awk '/^default / {print $3; exit}')"
+          ruby -ripaddr -e \
+            'address = IPAddr.new(ARGV.fetch(0)); exit(address.ipv4? && address.private? ? 0 : 1)' \
+            "$probe_host"
+          echo "OPENCODE_PROBE_HOST=$probe_host" >> "$GITHUB_ENV"
       - name: Exercise the complete manifest matrix without artifact claims
         env:
           BUNDLE_GEMFILE: ${{ github.workspace }}/ruby-client/Gemfile