M3b review fixes by the design model: curl --globoff, podman --pull=never

Review findings 1 and 2, both plan defects. curl gains --globoff and a
leading --disable; both podman runs gain --pull=never. The given fetch.rs and
the six golden files change with them. Checked on straylight with a rebuilt
image: a glob URL is one request, a missing image fails at once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/brokerd/tests/fixtures/podman/egress.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7-egress
 --label=boxmaker=egress
 --network=pasta
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges