test: keep tests off the network

- conftest refuses socket connections outside tests marked integration
- the one test that probed Yahoo for real now stubs the reachability check

tests/conftest.py

@@ -1,6 +1,7 @@
 """Shared pytest fixtures that prevent CI hangs when API keys are absent."""
 
 import os
+import socket
 
 import pytest
 
@@ -31,6 +32,19 @@ def pytest_configure(config):
         config.addinivalue_line("markers", f"{marker}: {marker}-level tests")
 
 
+@pytest.fixture(autouse=True)
+def _no_network(request, monkeypatch):
+    """Tests do not reach the network; one that must is marked integration."""
+    if request.node.get_closest_marker("integration"):
+        return
+
+    def refuse(self, address):
+        raise OSError(f"test tried to reach the network: {address}")
+
+    monkeypatch.setattr(socket.socket, "connect", refuse)
+    monkeypatch.setattr(socket.socket, "connect_ex", refuse)
+
+
 _API_KEY_ENV_VARS = (
     "OPENAI_API_KEY",
     "GOOGLE_API_KEY",