H0: harden upstream RSS XML parsing

[Pigbibi]

Scope

• Replace direct stdlib xml.etree.ElementTree parsing with pinned defusedxml==0.7.1.
• Bound network reads to MAX_XML_BYTES + 1 and fail closed before parsing.
• Sanitize defusedxml, parse, encoding, and size failures through the existing feed failure path.
• Preserve existing RSS/Atom primitive row shape and partial/debug behavior.

Contract boundary

• Producer-owned raw XML only; no typed status, weekly artifact, workflow, QAR, or publish changes.
• No stdlib XML fallback or monkey-patching.
• uv.lock pins defusedxml 0.7.1 with the package sdist/wheel SHA-256 hashes.

Verification

• Focused: uv run pytest -q tests/test_rss_source_fetch.py (14 passed)
• Full locked: uv sync --locked --extra test && uv run pytest -q (122 passed)
• python3 -m compileall -q src scripts tests passed
• git diff --check passed
• ruff unavailable in the environment

Closes no production integration; H1 typed status remains deferred until this PR merges and post-merge CI succeeds.

[github-actions]

🤖 Codex PR Review

✅ Merge allowed: No issues found

---

Review by Codex PR Review bot • PR