fix(coding): remediate ML-07 plugin authority

tests/unit/plugin-policy-client.test.ts

@@ -120,4 +120,29 @@ describe('PluginPolicyClient', () => {
       errorCode: 'plugin_backend_unavailable',
     });
   });
+
+  it.each(['headers', 'body'] as const)(
+    'bounds a catalog request whose %s never settle',
+    async (phase) => {
+      const fetchImpl = vi.fn((_input: string | URL, init?: RequestInit) => {
+        if (phase === 'headers') {
+          return new Promise<Response>((_resolve, reject) => {
+            init?.signal?.addEventListener('abort', () => reject(init.signal?.reason), { once: true });
+          });
+        }
+        return Promise.resolve(new Response(new ReadableStream<Uint8Array>({
+          start(controller) {
+            init?.signal?.addEventListener('abort', () => controller.error(init.signal?.reason), { once: true });
+          },
+        }), { status: 200, headers: { 'content-type': 'application/json' } }));
+      });
+      const client = new PluginPolicyClient({ fetchImpl, requestTimeoutMs: 20 });
+
+      await expect(client.refresh()).resolves.toMatchObject({
+        status: 'unavailable', catalog: null, revision: 0,
+        errorCode: 'plugin_backend_unavailable',
+      });
+      expect(fetchImpl).toHaveBeenCalledOnce();
+    },
+  );
 });