## Summary
- `fetch_content_type`'s `requests.head()` call verifies TLS by default -- this pod's CA trust store doesn't include the cluster's own self-signed CA, so a HEAD against an `https://plevion.com/...` overlay URL fails cert verification (`SSLCertVerificationError`, a `requests.RequestException` subclass) and silently returns `None`, indistinguishable from the URL genuinely being unreachable. This was the actual blocker left after #121 fixed the SSRF-guard rejection -- the guard now passes, but this second check still failed with `COMP_SOURCE_005` ("URL must point to an HTML page for an interactive source").
- Skips verification under the exact same double-gated bypass as `is_public_url` (`ALLOW_PRIVATE_OVERLAY_URLS` + `is_local_environment()`), never for a real deployment.