M3b review fixes by the design model: curl --globoff, podman --pull=never

Review findings 1 and 2, both plan defects. curl gains --globoff and a
leading --disable; both podman runs gain --pull=never. The given fetch.rs and
the six golden files change with them. Checked on straylight with a rebuilt
image: a glob URL is one request, a missing image fails at once.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/plans/M3b/README.md

@@ -82,6 +82,12 @@ At the end: `make gate` prints `gate: ok` with about 638 tests.
   pass (11 of 11, five runs, clippy clean) and removed that. Task 12 now calls `run_container`.
   Resume from task 11.
 
+- 2026-09-23, after the review: two plan defects found on straylight were fixed by the design
+  model: `curl` gains `--globoff` (and a leading `--disable`), since `[1-3]` in a URL made three
+  requests; both `podman run`s gain `--pull=never`, since a missing image made Podman try to pull.
+  The given `fetch.rs` and the six golden files changed with them. Follow-up tasks 14 to 16 are for
+  the implementer.
+
 ## Running it
 
 ```sh

docs/plans/M3b/files/crates/brokerd/tests/fixtures/podman/egress.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7-egress
 --label=boxmaker=egress
 --network=pasta
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

docs/plans/M3b/files/crates/brokerd/tests/fixtures/podman/http_fetch.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

docs/plans/M3b/files/crates/brokerd/tests/fixtures/podman/read_file.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

docs/plans/M3b/files/crates/brokerd/tests/fixtures/podman/shell.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

docs/plans/M3b/files/crates/brokerd/tests/fixtures/podman/shell_no_paths.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

docs/plans/M3b/files/crates/brokerd/tests/fixtures/podman/write_file.args

@@ -4,6 +4,7 @@ run
 --name=boxmaker-s1-1-7
 --label=boxmaker=tool
 --network=none
+--pull=never
 --read-only
 --cap-drop=all
 --security-opt=no-new-privileges

docs/plans/M3b/files/crates/toolkit/tests/fetch.rs

@@ -39,8 +39,10 @@ fn args() -> HttpFetchArgs {
 #[test]
 fn the_argument_list_is_fixed_and_ends_with_the_url() {
     let expected: Vec<&str> = vec![
+        "--disable",
         "--silent",
         "--show-error",
+        "--globoff",
         "--proto",
         "=https",
         "--proto-redir",