Use when a GraphQL API must be hardened or audited against denial of service and schema disclosure. Sends over-limit depth and cost queries and asserts they are rejected, proving graphql-depth-limit, cost analysis or graphql-armor are enforced; covers introspection and persisted-query allowlists.