[P2] Investigate intermittent macOS public NuGet route failures in CI #3493

Two completed macOS ARM64 CI jobs in PR #3487 failed public NuGet restore with NU1301 and No route to host (api.nuget.org:443). This is an infrastructure investigation, not an emitted-code semantic defect or an introducing-commit claim. The runner/network root cause has not been established.

1. Desktop GUI job at 73ad1e0d9dade657805f65f4fad776a0452a9b6d: hosted/lifecycle and renderer/productization conformance passed before the packaged template's dotnet restore ... -r osx-arm64 failed. The log records repeated failures retrieving Microsoft.NETCore.App.Runtime.osx-arm64 and Microsoft.AspNetCore.App.Runtime.osx-arm64 from https://api.nuget.org/v3-flatcontainer/... with the routing error, followed by NU1301. The packaged native/real-window certification did not complete.

2. Native generated-program job, attempt 1, at f9d85818835fd5b341749db1e2a9d208e984f1b2: all 17 genuine native corpus programs published and executed successfully. Candidate SDK packaging and the managed SDK build/rebuild/clean/publish checks passed. The isolated native SDK consumer's restore then failed loading https://api.nuget.org/v3/index.json with the same NU1301/No route to host error. This failure occurs before native SDK compilation/execution; no successful native SDK summary exists for that attempt. The other five native RID jobs passed their corpus and native SDK checks.

The first attempt's failure log and partial artifact are retained. One unchanged, same-head rerun of only the failed macOS ARM64 native job was authorized after the external routing error was established. Its outcome is a separate observation and must not be presented as fixing this recurring infrastructure issue. No source, assertion, timeout, exclusion, retry policy, package source or warning baseline was changed for that control.

Expected: the required public-feed restores and final native SDK/GUI execution checks complete reliably under their existing deadlines. Investigate hosted-runner routing/DNS/connectivity and package-cache/feed behavior using retained diagnostics while preserving package integrity and the full existing gates. Do not suppress restore failures, claim that an incomplete native smoke passed, or increase deadlines as a substitute for diagnosis.

Local evidence: artifacts/p3-work/ci-final-macos-gui-failure.log (prior route errors at lines 384–426); artifacts/p3-compiler/fresh-f9-ci/native-osx-arm64-complete.log (current route errors at lines 301–348); native-osx-arm64-attempt1-failure.json; and the preserved native-receipts/osx-arm64/native-guest/.../summary.json with completed: true, expectedCases: 17 and all 17 case receipts.