Restrict refresh_remote to bounded HTTP(S) fetches

[seanwevans]

Issue

policy.refresh_remote is documented (API.md) as fetching policy YAML over HTTP, but it passed the caller-supplied URL straight to urllib.request.urlopen and read the response with an unbounded fh.read():

• urllib accepts file:// and ftp:// URLs, so a mis-plumbed URL silently turns the policy fetch into a local-file read primitive.
• A hostile or misbehaving policy server can stream an arbitrarily large response, which is buffered in full before any schema validation runs.

Fix

• Reject any URL whose scheme is not http/https with a ValueError before opening the connection.
• Cap the response body at _MAX_REMOTE_POLICY_BYTES (1 MiB — generous for YAML policy documents) and raise ValueError when exceeded.

Existing behavior is otherwise unchanged: timeout retries, temp-file handling, and the refresh() pipeline are untouched.

Testing

• New test_refresh_remote_rejects_non_http_scheme (a file:// URL raises before any fetch) and test_refresh_remote_rejects_oversized_response (a local HTTP server serving 1 MiB + 1 gets rejected).
• Full suite: 411 passed, 2 environment-gated skips; all pre-commit hooks (isort, black, pylint, flake8, mypy) pass.

Note: while adding these tests I found that tests/test_remote_policy.py fails when run as a standalone file on current main — two pre-existing tests depend on an earlier test file leaving the global policy token set. That's unrelated to this change; fix coming in a separate PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DDSofWX5HwawsrwbN2nSXR

---

Generated by Claude Code