Isolate local native Docker curl requests

[TheRealBecks]

Closes #78.

Scope

Isolate all three existing native daemon curl call sites from default curl configuration and ambient proxy routing using first-option -q and literal --noproxy '*'. Requests, methods, invocation counts, deadlines, startup cadence, selected executables, inherited environment, privileges and cleanup remain unchanged. No configuration, credential or environment values are inspected or cleared.

Independent fake-client expectations cover complete argv, polling retries, final readiness fallback, API GET success/failure, exact call counts and a real wildcard-expansion canary. This is harness trust-boundary hardening, not a diagnosis of historical failures or a new capability admission.

Verification

• Independent source review cleared the exact three-file delta SHA256 5b469facc75306ebd13a310f48d77f758b6ed969d156a423b1a79c87c37b90c4 against main 4880af43013bcc8cdfe1507719a0699b303fcc6b.
• 48 native-harness, 6 watchdog and 7 scaffold-policy tests passed. Existing cleanup/TERM/KILL checks remain intact.
• Primary ran canonical ./scripts/format-lint.sh --fix, then the COMPLETE ./scripts/check-all.sh --check; status0, unchanged before/after source fingerprint. Private record /tmp/dl78-complete-gate.Qlh8wnZU; complete log SHA256 8156176603dec78f0a28c0e4a6bec2efb40ad5f165db639a0d5b9d05570f0764.
• Fresh exact-head four-lane native validation is still pending. Draft until that evidence and normal hosted checks pass; no compatibility or release claim from offline results.

Consumers and Renovate

The canonical native harness remains shared by local execution, main check.yml, reviewed native-validation.yml, and exact-main release-validation.yml. No workflow, operational pin, extraction path, manager grouping or approval rule changed. Original policy regression verifies unique extraction of all five unchanged image/fixture tag/digest pairs. Historical evidence is unchanged.

BoxFerry parses this script's catalogue provenance but does not execute these three curl sites. Its frozen #49 producer/receipt/script-digest binding is preserved. A different harness root cannot be adopted by refreshing a hash alone: a separately reviewed consumer contract or genuinely new verified producer build and receipt is required. This PR does not claim that downstream adoption or volume/application acceptance has happened.

Releases, publication and deployment remain manual and outside this PR's authority.