Disable proxy discovery and redirect following so validated Ollama origins cannot escape the approved network boundary. Run the standard-library safety suite in CI.