fix(ai): confine benchmark requests

Disable proxy discovery and redirect following so validated Ollama origins cannot escape the approved network boundary. Run the standard-library safety suite in CI.

scripts/test-ollama-evaluation.py

@@ -4,7 +4,9 @@ import importlib.util
 import json
 import tempfile
 import unittest
+import urllib.request
 from pathlib import Path
+from unittest import mock
 
 
 SCRIPT = Path(__file__).with_name("run-ollama-evaluation.py")
@@ -54,6 +56,13 @@ class OllamaEvaluationTests(unittest.TestCase):
             MODULE.validate_base_url("http://ollama:11434", True)
         self.assertEqual("http://192.168.1.20:11434", MODULE.validate_base_url("http://192.168.1.20:11434", True))
 
+    def test_http_opener_disables_proxies_and_redirects(self):
+        with mock.patch.object(urllib.request, "getproxies", side_effect=AssertionError("proxy discovery must stay disabled")):
+            opener = MODULE.build_http_opener()
+        self.assertFalse(any(isinstance(handler, urllib.request.ProxyHandler) for handler in opener.handlers))
+        self.assertTrue(any(isinstance(handler, MODULE.NoRedirectHandler) for handler in MODULE.HTTP_OPENER.handlers))
+        self.assertIsNone(MODULE.NoRedirectHandler().redirect_request(None, None, 302, "Found", {}, "http://example.invalid"))
+
 
 if __name__ == "__main__":
     unittest.main()