test: use example.test placeholder host, not .invalid

leak-guard bans the .invalid TLD (grouped with private .internal/.local/etc);
example.test is the RFC 6761 reserved test TLD — equally unreachable, not on
the ban list — so the leak-guard CI check passes.

src/keydb.rs

@@ -846,7 +846,7 @@ mod tests {
 
         let body = b"0xAABBCCDDAABBCCDDAABBCCDDAABBCCDD = Test\n".to_vec();
         let result = src
-            .update(|_url| Ok(body.clone()), "http://example.invalid/keydb.zip")
+            .update(|_url| Ok(body.clone()), "http://example.test/keydb.zip")
             .expect("update must succeed with a good fetch");
 
         assert_eq!(result.path, target, "update must save to the source's path");

src/online.rs

@@ -416,7 +416,7 @@ mod tests {
     /// it's the deliberate no-op stub.
     #[test]
     fn host_certs_is_noop_empty_no_network() {
-        let src = OnlineSource::new("http://example.invalid/keys", "secret");
+        let src = OnlineSource::new("http://example.test/keys", "secret");
         assert!(
             KeySource::host_certs(&src, None).is_empty(),
             "online host_certs must be an empty no-op (no network)"

tests/key_sources.rs

@@ -225,7 +225,7 @@ fn online_source_unconfigured_is_silent_no_op() {
 
 #[test]
 fn online_source_metadata() {
-    let src = OnlineSource::new("https://example.invalid/keys", "tok");
+    let src = OnlineSource::new("https://example.test/keys", "tok");
     assert_eq!(src.label(), "online");
     // No host-cert serving today — a no-op empty, no network touched.
     assert!(KeySource::host_certs(&src, None).is_empty());