M3b review fixes by the design model: curl --globoff, podman --pull=never

Review findings 1 and 2, both plan defects. curl gains --globoff and a
leading --disable; both podman runs gain --pull=never. The given fetch.rs and
the six golden files change with them. Checked on straylight with a rebuilt
image: a glob URL is one request, a missing image fails at once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/brokerd/src/podman.rs

@@ -23,6 +23,9 @@ pub fn container_name(session: &SessionId, call: CallId, n: u64) -> String {
 /// takes the runner's, the proxy its fixed limits.
 fn hardening(pids: u32, memory: &str) -> Vec<OsString> {
     [
+        // A missing image is an error at once, never a pull: a pull is egress, and what runs must
+        // be exactly the image built for it.
+        "--pull=never",
         "--read-only",
         "--cap-drop=all",
         "--security-opt=no-new-privileges",

crates/brokerd/tests/fixtures/podman/egress.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7-egress
 --label=boxmaker=egress
 --network=pasta
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

crates/brokerd/tests/fixtures/podman/http_fetch.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

crates/brokerd/tests/fixtures/podman/read_file.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

crates/brokerd/tests/fixtures/podman/shell.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

crates/brokerd/tests/fixtures/podman/shell_no_paths.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

crates/brokerd/tests/fixtures/podman/write_file.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

crates/toolkit/src/fetch.rs

@@ -22,8 +22,12 @@ const MAX_STDERR: usize = 64 * 1024;
 /// `curl`'s arguments for `url`, in order, without the program name.
 pub fn curl_args(url: &str) -> Vec<String> {
     vec![
+        // First, or it has no effect: never read a `.curlrc`.
+        "--disable".to_string(),
         "--silent".to_string(),
         "--show-error".to_string(),
+        // `[1-99999999]` in a URL is text, not millions of requests to the allowed host.
+        "--globoff".to_string(),
         "--proto".to_string(),
         "=https".to_string(),
         "--proto-redir".to_string(),

crates/toolkit/tests/fetch.rs

@@ -39,8 +39,10 @@ fn args() -> HttpFetchArgs {
 #[test]
 fn the_argument_list_is_fixed_and_ends_with_the_url() {
     let expected: Vec<&str> = vec![
+        "--disable",
         "--silent",
         "--show-error",
+        "--globoff",
         "--proto",
         "=https",
         "--proto-redir",