fix(cv-import): bound source retention and guard worker recovery

tools/summarizer/cv_import_ai.py

@@ -5,7 +5,7 @@ import json
 import os
 import re
 from urllib.parse import urlsplit
-from urllib.request import Request, urlopen
+from urllib.request import Request, build_opener, HTTPRedirectHandler, ProxyHandler
 
 
 @dataclass(frozen=True)
@@ -51,10 +51,15 @@ def _validate_config(config):
             raise ValueError("Only local provider addresses are supported.")
 
 
+class _NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        raise ValueError("Local inference redirects are not allowed.")
+
+
 def _ollama(config, payload):
     request = Request(config.base_url.rstrip("/") + "/api/generate", data=json.dumps(payload).encode(), headers={"Content-Type": "application/json"})
     # The application adapter never installs/pulls models or changes a model cache.
-    with urlopen(request, timeout=config.timeout_seconds) as response:
+    with build_opener(ProxyHandler({}), _NoRedirect()).open(request, timeout=config.timeout_seconds) as response:
         body = response.read(256 * 1024 + 1)
     if len(body) > 256 * 1024:
         raise ValueError("Model output exceeded its bound.")