fix(e2e): read the network block from either curl wording, so main's e2e runs its shards again

scripts/ci/e2e-case-times.tsv

@@ -102,7 +102,7 @@ nextflow-from-fastq-2-nextflow	shard	724	nextflow-from-fastq-1-bash
 nextflow-from-fastq-3-sexcheck	shard	97	-
 nextflow-hardening-1-manta	shard	21	-
 nextflow-hardening-2-nf	shard	643	bash-step-19-delly,nextflow-hardening-1-manta
-nextflow-report-parity-1-sections	shard	206	clinvar-clip-check-1
+nextflow-report-parity-1-sections	shard	206	clinvar-clip-check-1,comphet-phasing-1-reads
 paralog-catalog-1-gba	shard	114	-
 paralog-checks-and-doc-fixes-1-hba	shard	57	-
 paralog-rows-1	shard	316	-

scripts/ci/e2e-run.sh

@@ -604,6 +604,11 @@ data_name() {
 # Every HTTP(S) request of a process run under it goes to a closed port.
 OFFLINE=(env http_proxy=http://127.0.0.1:9 https_proxy=http://127.0.0.1:9 HTTP_PROXY=http://127.0.0.1:9
          HTTPS_PROXY=http://127.0.0.1:9 no_proxy= NO_PROXY= FETCH_TRIES=1 FETCH_WAIT=0)
+# offline_blocked CURL_ERROR: true when curl's error says the request went to
+# the closed proxy of OFFLINE, in either wording curl uses.
+offline_blocked() {
+  grep -qE '127\.0\.0\.1( port |:)9\b|via 127\.0\.0\.1\b' <<< "$1"
+}
 # data_seed CASE: before CASE, its files from E2E_DATA_CACHE. A failure here
 # only warns and costs the download: setup.sh in the case fetches what is
 # not there. Sets CASE_ENV to OFFLINE when the case's entry says "offline"
@@ -631,11 +636,14 @@ data_seed() {
   [ "$flag" = offline ] && $placed || return 0
   # Control: under OFFLINE a request to a host that answers must fail, or
   # the offline run would prove nothing.
-  # Read from curl's own error, so a host that is down cannot pass for it.
+  # Read from curl's own error, so a host that is down cannot pass for it:
+  # the error must name the closed proxy. curl words it two ways: older
+  # releases "Failed to connect to 127.0.0.1 port 9", newer ones "Failed to
+  # connect to <host> port 443 via 127.0.0.1" (the 26.04 runners, 2026-11-05).
   # (A variable, not a pipe: under pipefail curl's own failure would fail it.)
   local out
   out=$("${OFFLINE[@]}" curl -fsS --max-time 20 -o /dev/null https://raw.githubusercontent.com/ 2>&1 || true)
-  if ! grep -q '127\.0\.0\.1.* 9\b' <<< "$out"; then
+  if ! offline_blocked "$out"; then
     echo "$out"
     echo "::error::Data cache: a request under the network block did not fail at the closed port; ${1%.sh} runs with the network and counts as failed"
     CASE_CONTROL_FAILED=true

tests/test_e2e_data_cache.sh

@@ -59,4 +59,20 @@ if [ -n "$other" ] && [ -n "$pin" ] && [ -n "$gencode" ] \
 else echo "FAIL: the hla key does not match its inputs (${other:-?} ${pin:-?} ${gencode:-?}): ${key}"; failed=1; fi
 if "$RUN" --data-key pgs | grep -qE '^e2e-data-pgs-[0-9a-f]{16}$'; then echo "PASS: the pgs key is a hash"
 else echo "FAIL: the pgs key"; failed=1; fi
+# The network-block control: curl's error must name the closed proxy, in
+# either wording curl uses, and an error that never reached the proxy must
+# not pass for it (a host that is down, a name that does not resolve).
+fn=$(sed -n '/^offline_blocked() {/,/^}/p' "$RUN")
+[ -n "$fn" ] || { echo "FAIL: no offline_blocked function in e2e-run.sh"; exit 1; }
+eval "$fn"
+blocked() {
+  local rc=0
+  offline_blocked "$3" || rc=1
+  if [ "$rc" = "$2" ]; then echo "PASS: $1"; else echo "FAIL: $1 (got ${rc}, want $2)"; failed=1; fi
+}
+blocked "the block: older curl wording" 0 "curl: (7) Failed to connect to 127.0.0.1 port 9 after 0 ms: Couldn't connect to server"
+blocked "the block: newer curl wording (via the proxy)" 0 "curl: (7) Failed to connect to raw.githubusercontent.com port 443 via 127.0.0.1 after 0 ms: Could not connect to server"
+blocked "not the block: the host refused, no proxy" 1 "curl: (7) Failed to connect to raw.githubusercontent.com port 443 after 12 ms: Connection refused"
+blocked "not the block: the name did not resolve" 1 "curl: (6) Could not resolve host: raw.githubusercontent.com"
+blocked "not the block: no error at all" 1 ""
 exit "$failed"