Stabilize PyPI source spec

[MikeMcQuaid]

• avoid live pypi.org lookups in cmd/source specs so the regression is deterministic
• keep coverage on pypi_repo_url package parsing by asserting the expected JSON API request

---

• Have you followed the guidelines in our Contributing document?
• Have you checked to ensure there aren't other open Pull Requests for the same change?
• Have you added an explanation of what your changes do and why you'd like us to include them? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you written new tests (excluding integration tests) for your changes? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) with your changes locally?

---

• AI was used to generate or assist with generating this PR. Please specify below how you used AI to help you, and what steps you have taken to manually verify the changes. Non-maintainers may only have one AI-assisted/generated PR open at a time.

Used OpenAI Codex xhigh with manual review.

---

[Copilot]

Pull request overview

This PR stabilizes the cmd/source PyPI URL specs by removing live pypi.org dependency and asserting the expected JSON API request, making the regression test deterministic.

Changes:

• Stub Utils::Curl.curl_output in #pypi_repo_url specs to avoid network access.
• Assert the exact PyPI JSON API URL requested for given PyPI package tarball URLs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.