[Task]: wingetbot worker — URL/domain 403 class learnings

Nobody has claimed this yet.

### Description

Per-class learning tracker for the **wingetbot auto-update PR triage worker** (#411124). Capture evidence and heuristics for the **URL / domain reachability (403 Forbidden)** class here.

**Labels:** `Validation-Forbidden-URL-Error`, `Validation-Domain`, `Validate-Domain-Installer`, `Validation-Agreement-Domain`

### Current disposition (from the 2026-08-01 pilot)

**Diagnose + route → waiver.** A URL 403s the validation service (WAF/geo/UA) but is fine for real users. Ties to the waiver discussion in #408472.

### Learnings so far

- Examples #410681 (`pos-api.coupang.com`) and #410284 (`downloads.npass.app`): **a HEAD from a normal client returned 200 for both**, while the validation service got 403 → the block is service-specific, not a broken URL.
- **Reliable, cheap signal:** `service-got-403` + `normal HEAD = 200` ⇒ **recommend a moderator waiver**, do **not** tell anyone the URL is broken. Distinct from a genuine 404 (dead URL) like #411061's `ReleaseNotesUrl`, where removing the optional field is the fix.
- `Validation-Domain` already escalates to humans by design (canned reply + ICM/moderator assignment) — the worker must complement, not fight, that flow.

### Open questions / learnings to capture

- [ ] Distinguish **installer-URL** 403 (blocks validation entirely, needs waiver) from **metadata-URL** 403 (privacy/ToS — lower stakes).
- [ ] Should the worker replicate the validation service's UA to reproduce the 403 precisely, or is HEAD-200 enough evidence?
- [ ] How does this feed the #408472 waiver mechanism — auto-suggest a `.validation` waiver entry for a moderator to approve?

Parent: #411124

_Created with GitHub Copilot assistance._

Start by reading the parent worker issue #411124, the waiver discussion in #408472, and the referenced examples #410681, #410284, and #411061. Compare installer-URL and metadata-URL 403 cases, then document the agreed evidence and how the worker should route them; the open questions need resolution before completion can be defined.

Written by the indexing model from the issue text.