Post-hoc /trekreview (WARN, scope 0670b2a..b513e64) surfaced 2 findings, both closed:
- MAJOR MISSING_TEST: the non-https scheme guard (preflight.py:61) and non-azure
profile refusal (:82-86) had zero test coverage — added
test_non_https_endpoint_refused + test_non_azure_profile_refused so an inverted
condition can't regress silently.
- MINOR MISSING_ERROR_HANDLING: an existing-but-unreadable PORTFOLIO_MODEL_MAP
raised PermissionError (an OSError, not ValueError) past the except at :95 →
widened to OSError (subsumes FileNotFoundError). test_unreadable_override_is_
structured_refusal proves the traceback-free invariant (red pre-fix).
Suite 348->351/4, ruff+format+mypy clean.
