feat/atlas-scan

Exponential backoff still runs on hard SSL/network errors

scripts/atlas/distribucion/dist_common.py:101

When an exception fires, `last_err = e` is set and `txt = ''`, but execution falls through to `time.sleep(delay)`. On a persistent hard error (the very case this fix addresses), the caller still waits ~11 minutes (3+6+12+…+120s) before RuntimeError is raised. A `continue` after `last_err = e` would skip the sleep on connection-level failures. With CERT_NONE now active, SSL errors are resolved upstream, so this is dormant in practice — but the logic remains wrong conceptually.

Mixed-failure scenario: last exception may shadow the real root cause

scripts/atlas/distribucion/dist_common.py:96

`last_err` is overwritten on every retry. If early retries fail with SSL and later retries get shell HTML (no exception), `last_err` is still set but `ShellBlocked` is raised — the SSL cause is lost. Storing only the first error (`if last_err is None: last_err = e`) would preserve the original root cause for debugging.

`last_err` overwritten each iteration — only last exception survives

scripts/atlas/distribucion/dist_common.py:100

If multiple different errors occur across retries, only the last one is reported in RuntimeError. Use `if last_err is None: last_err = e` to preserve the first (and typically most diagnostic) error.

Fix correctly distinguishes SSL errors from rate-limit blocks

scripts/atlas/distribucion/dist_common.py

The core logic is sound: after exhausting retries, `last_err is not None` → RuntimeError (network/SSL); `last_err is None` → ShellBlocked (rate-limit). The distinction works correctly for the common case.

CERT_NONE is the wrong fix — truststore or system CA bundle preserves verification

scripts/atlas/distribucion/dist_common.py:29

The comment itself states CFE's cert validates in the system/curl trust store — just not in Python's bundled certifi. The correct fix is `pip install truststore` + `truststore.inject_into_ssl()` at script startup, or passing `cafile='/etc/ssl/certs/ca-certificates.crt'` to `ssl.create_default_context()`. CERT_NONE removes ALL TLS integrity permanently, even if CFE fixes their chain or this module is reused elsewhere. For a one-off research script on a trusted network the operational risk is low (no credentials transmitted, public data only), but the pattern is wrong and the correct fix is straightforward.

Module-level _SSL singleton with CERT_NONE affects all callers

scripts/atlas/distribucion/dist_common.py:27

`_SSL` is a mutable module-level singleton. Any code that imports `dist_common` and calls `_opener()` will silently get a no-verify TLS context. Acceptable for a single-file script, but should be annotated as `# INTERNAL — do not reuse outside this module` to prevent accidental reuse.

capacidad() has the same exception-swallowing pattern — not fixed by this diff

scripts/atlas/distribucion/dist_common.py:120

`capacidad()` still uses `except Exception: time.sleep(...)` returning None. The same rationale (SSL errors ≠ rate-limit) applies. Out of scope for this commit but worth a follow-up.

`attempt` variable unused in loop — use `_`

scripts/atlas/distribucion/dist_common.py:97

`for attempt in range(retries)` — `attempt` is never read; backoff uses `delay` directly. Replace with `for _ in range(retries)` to signal the variable is intentionally unused.