6-round RCE-class security hardening, converged. Codex SAFE (live exploit probes) + Opus SAFE (flag-off-reachability enumeration) + full suite 9508 on the byte-identical gated head. Nathan signed off.
Co-authored-by: Rod Boev <rod.boev@gmail.com>
Closes#3879Closes#3777
Pre-existing failure on master: the test assumed only the broken-proxy /v1/models call would route through fake_urlopen, but get_available_models() also probes the Copilot internal v2 token endpoint (10.0s timeout) and OpenRouter free-tier discovery (8.0s), which now pollute the recorded timeout list.
Fix narrows the recorder to the broken-proxy endpoint only. The contract being pinned (broken-proxy probe uses CUSTOM_MODELS_ENDPOINT_TIMEOUT_SECONDS, not the urllib default 10) is unchanged.
Caught by stage-batch33 sequential pytest gate.
nesquena-hermes