M3b review fixes by the design model: curl --globoff, podman --pull=never

Review findings 1 and 2, both plan defects. curl gains --globoff and a
leading --disable; both podman runs gain --pull=never. The given fetch.rs and
the six golden files change with them. Checked on straylight with a rebuilt
image: a glob URL is one request, a missing image fails at once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

crates/toolkit/src/fetch.rs

@@ -22,8 +22,12 @@ const MAX_STDERR: usize = 64 * 1024;
 /// `curl`'s arguments for `url`, in order, without the program name.
 pub fn curl_args(url: &str) -> Vec<String> {
     vec![
+        // First, or it has no effect: never read a `.curlrc`.
+        "--disable".to_string(),
         "--silent".to_string(),
         "--show-error".to_string(),
+        // `[1-99999999]` in a URL is text, not millions of requests to the allowed host.
+        "--globoff".to_string(),
         "--proto".to_string(),
         "=https".to_string(),
         "--proto-redir".to_string(),