- Cover host allow-list, dotted-suffix bypass, dial-time private IP - Cover no-follow redirects, streaming byte cap, and D-14 config defaults
- Port PHP PRIVATE_V4_CIDRS and PRIVATE_V6_PREFIXES onto netip.Prefix - Fail closed on invalid addresses; Unmap remains the caller's job
- Table-driven cases port PHP PRIVATE_V4_CIDRS/PRIVATE_V6_PREFIXES - Document Unmap() as the caller responsibility for v4-mapped literals