Tests whether speculative fetch mechanisms — modulepreload, Speculation Rules API (prefetch/prerender documents), and <link rel="prerender"> — can fetch or pre-render external documents outside the allowlist. Speculation rules are particularly dangerous because they trigger full document loads (including JS execution) speculatively. CORS fetch oracle confirms domain reachability.