/**
 * test_security_download_and_scan.ts — Stories 9.1 + 9.2
 *
 * Asserts:
 *   1. SecurityDownloadGuard.downloadAndScan() refuses untrusted URLs
 *   2. downloadAndScan() returns errors for unreachable hosts
 *   3. downloadAndScan() rejects blocked filename patterns (e.g. .exe)
 *   4. ExternalCatalogRegistry.import() returns policy decision (no fetch)
 *   5. ExternalCatalogRegistry.importAndFetch() reports network failure
 *      gracefully (we can't actually reach github.com in test env)
 *
 * NOTE: No live network calls expected on CI; all assertions verify
 * graceful failure modes, never success-with-network.
 */
export {};
