- Add yolo_only_enforce_blocklist to user config, requirements, API schemas, and debug output.
- Make full-access proxy runtime enforce denylist-only mode while preserving deny precedence.
- Prevent managed allowlist-only requirements from being bypassed by user blocklist-only yolo settings.
- Keep managed-config ignore helper test-only so release builds do not ship an env-var bypass.