Separate hermetic tests from scheduled external contracts

[Claudio9701]

Outcome

Keeps every PR deterministic and socket-disabled while moving respectful provider drift detection and a small real OSRM lifecycle exercise to weekly/manual contracts.

What changed

• adds a shared identifying HTTP session with finite connect/read timeouts, pooling, bounded GET retries, and Retry-After support
• deliberately excludes POST from automatic retries
• migrates direct Nominatim/Overpass/routing calls away from timeout-free module requests
• replaces brittle exact live road-network assertions and the country-scale Peru Docker test
• adds structural Geofabrik, HDX, and Overpass/OSMnx live contracts
• adds an end-to-end canonical liechtenstein OSRM prepare/start/query/stop/clean test
• schedules both jobs weekly and supports manual dispatch with strict time limits
• preserves Docker diagnostics on failure
• documents the explicit pytest override required to re-enable sockets
• narrows NetworkX exception handling and restores deterministic route coverage

Verification

• default hermetic suite: 65 passed, 4 intentional live/Docker deselections
• all 3 live provider contracts passed locally in 5.77 seconds
• shared timeout/retry tests passed
• Ruff clean
• Trunk/actionlint checked 134 files with no issues
• Docker integration not run locally because Docker is absent; GitHub's scheduled/manual Ubuntu runner is its acceptance environment

Stack

Base: #91
Roadmap: #61
Parents: #67 and #68

Closes #92
Closes #93