network-tiers: CI reputation check on PROPOSED balanced-allowlist additions

[wz-gsa]

Part of the neutral-network-tiers epic (ADR 0002 isolation, PR #299).

Scope

A CI-time validator that, when a PR ADDS a domain to the balanced baseline allowlist, checks the new domain(s) against a reputation/threat source and surfaces the signal on the PR for the human reviewer.

Requirements

• CI-time only — NOT a runtime egress blocklist (redundant under deny-by-default; would break acq's offline/deterministic/no-hang contract).
• Runs only on the diff (added domains), not the whole list.
• Bounded/fail-safe: if the reputation source is unreachable, the check WARNS (doesn't hard-fail the PR) and defers to human review — never blocks CI on an external outage.
• No secrets; if a reputation API needs a token, document it and degrade gracefully without it.
• Choose a reputation source that's appropriate for federal use (avoid vendors with problematic ToS/data-sharing); flag the choice for human approval.

Depends on the baseline-data issue. AI-assisted (OpenCode). Requires human review.

[wz-gsa]

Implemented in the #301 PR (folded in). Deterministic offline additions guard — no reputation API (3/3 consensus rejected a live feed as over-engineering + a federal data-sharing concern). ERRORs on raw-IP / public-suffix-wildcard; WARNs on punycode/risky-TLD/deep-nesting/unexpected-:80; warnings defer to CODEOWNERS + the per-host why. Fail-safe (no network to be unreachable). 14 tests.