From #954150, it appears there _is_ a code vs data distinction: tests
are allowed to use the network but not to download and run code.
https://ftp-master.debian.org/REJECT-FAQ.html Non-Main II
I intend to post a patch to autopkgtest to document this.
Manually running the tests in question before upload is still an option,
but is (a) easy to forget and (b) won't notice breakage due to changes
in other packages. (Debian has transition rules for testing
API/ABI-breaking changes before they reach unstable, but these in
practice apply only to compiled languages, not to Python modules.)
