[NO-TICKET] Keep the egress category test off the network

[mariojgt]

What changed

The egress case in tests/protect/every-phase-reports-the-rule-category.test.ts now passes screenDns: false. The test no longer makes a real DNS lookup, so it can't time out on a slow runner.

Why it failed

The Publish workflow stopped at Validate package because this one test hit vitest's 5s timeout. Egress screening is on by default, and before any rule is checked it resolves the hostname to make sure it doesn't point at an internal address. The test calls https://api.evil.com/x, so each run made a real DNS query from the CI runner. When that query was slow, the test ran past 5s. Nothing in the code under test was wrong.

Fix

• Turn off address screening for this case. It exists to check that an egress detection reports its rule's category. The rule matches on the hostname (egress.host contains evil.com), so the DNS step was never part of what the test covers.
• This is how other hostname-rule egress tests are already set up (egress-guard-lifecycle.test.ts, rule-shapes.test.ts).

Verified

• The test file passes in 39ms (it was hitting the 5s limit).
• Full npm test: 4281 passed, 7 skipped.

Out of scope, worth a follow-up

Other egress tests turn on egress: true without screenDns: false or a stubbed lookup. Any of them that calls a non-IP hostname also makes a real DNS query and can time out the same way. Giving the test setup a stub resolver by default would make the whole suite network-free, but that's a wider change than this fix.

Docs: not needed. Test-only change.

Field test: none outstanding. No shipped docs, prompt or dist/ code changed.

🤖 Generated with Claude Code

[coderbuds]

Test now disables DNS resolution preventing network calls during egress phase.

🎯 Quality: 90% Elite · 📦 Size: Tiny

📈 This month: Your 175th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[mariojgt]

/review