feat(P04): Phase 04 verification script + finalize_evidence URLError fix (T-4.4)

---ci---
phase: 4
milestone: v1.0
status: execute
persona: lead-developer
task: T-4.4
requirements:
  covered: [REQ-10, REQ-12]
review:
  p0: 1
  p1: 0
  p0_items:
    - id: P0-001
      location: scripts/finalize_evidence.py _request()
      issue: urllib.error.URLError (connection refused, DNS, timeout) was uncaught and stack-traced instead of returning clean JSON
      severity: P0 (the pipeline would crash on a Gitea outage instead of writing a clean failure event)
      fix: catch URLError in _request(); return (0, 'URLError: <reason>') so callers report cleanly
---/ci---

Wave 2, task T-4.4. scripts/verify_phase04.sh checks: (1) typecheck; (2)
pipeline.yml structure (3 inputs + 4 jobs + correct if: conditions +
finalize.needs=prod-gate); (3) pipeline.yml references all 5 core scripts
+ branch-pin doc; (4) issue-to-contract.yml structure (issues[opened] +
parse-and-trigger); (5) issue-to-contract.yml references (l3b_agent_stub
+ dispatch endpoint + contract-ref + issue number + GITEA_TOKEN +
new_branch); (6) finalize_evidence.py --help + missing file + missing
token (all exit 1 clean, no stack trace); (7) finalize_evidence.py
dead-host dry-run (exit 1, no stack trace). All 12 checks PASS.

The dead-host check caught a P0: finalize_evidence.py did not catch
urllib.error.URLError, so a connection-refused would stack-trace in the
pipeline. Fixed by catching URLError in _request() and returning
(0, 'URLError: <reason>') so callers report a clean JSON failure.

scripts/finalize_evidence.py

@@ -63,6 +63,11 @@ def _request(method: str, url: str, token: str, body: dict = None):
         except Exception:
             body_text = ""
         return exc.code, body_text
+    except urllib.error.URLError as exc:
+        # Network-level failure (connection refused, DNS, timeout). Return
+        # a synthetic 0 status + the reason so callers can report cleanly
+        # without a stack trace.
+        return 0, f"URLError: {exc.reason}"
 
 
 def get_existing_sha(host: str, owner: str, repo: str, path: str,