Parent: #6853
Related: #6856

Objective

Implement reusable security utility APIs for extension authors.

Proposal IDs covered

• P2-3 Security validation package
• P2-4 SSRF protection helpers

In scope

• Security validation helper interfaces and threat assumptions.
• SSRF safety helpers with secure defaults.
• Positive/negative tests and guidance for safe adoption.

Out of scope

• General output/logging APIs (Extension framework P2 output and logging helpers (P2-1..P2-2) #6946).
• Runtime process/shell/file utilities (Extension framework P3 runtime utilities (P3-1..P3-5) #6948).

Deliverables

• Validation helper API + implementation.
• SSRF protection helper API + implementation.
• Test coverage for normal + adversarial paths.
• Security guidance for extension consumers.

Verification checklist

• Safe defaults documented and enabled by default.
• DNS/IP and URL policy behavior is deterministic and test-backed.
• mage preflight passes.

Definition of done

• P2-3 and P2-4 are complete, tested, and documented.