Python Service: External Network Tests Are Opt-In

External network tests are opt-in, bounded, and non-blocking by default.

Rationale:
- Default CI must stay deterministic.
- Live integration coverage is useful, but it must not make baseline test runs flaky.

Scope:
- PR review policy for Python services in this repository.
- Applies to test changes that perform real network I/O to services not started by the local test harness (for example public APIs or shared remote services).
- Out of scope: localhost/in-process fakes, docker-compose services started as part of the test job, and pure mocks.

Trigger:
- A PR adds or changes an external network test in scope.

Approval checks:
1) External tests use the project-standard opt-in mechanism (marker and/or environment flag), and are skipped in default test mode.
2) External calls in those tests set explicit timeouts (do not rely on unbounded defaults).
3) The default service test command path is still expected to pass when the external dependency is unavailable.

Evidence:
- Diff shows the opt-in gating mechanism on external tests.
- Diff shows explicit timeout usage in external-call sites or fixtures.
- CI or local command output demonstrates default test path is not blocked by external outages.

Exception path:
- Allow deviation only when all are true:
1) PR description includes `Policy Exception: python-external-tests-opt-in`.
2) PR explains why always-on execution is required for this test.
3) PR documents reliability controls (for example retries/backoff/SLO ownership) and why CI risk is acceptable.

Decision:
- Return NOT APPROVED when trigger is met and any approval check fails without a valid exception.