A proxy-blocked artifact fetch now says whether it's a temporary scan outage or a permanent block.
What's wrong with this entry?
When the sandbox proxy blocks a fetch of artifact content with HTTP 403, the failure is now sorted into a temporary scan outage versus a permanent block, each with its own explanation, so the model knows whether to retry.
- A 403 whose reason ends in "(fail closed)" is treated as transient; other content-scan blocks are treated as permanent.
- A separate message covers proxy denials that are not content-scan related.
artifact content fetch blocked: the sandbox proxy's content scan was unavailable (HTTP 403). This is transient; retry.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.