Fix Ollama proxy bypass and quarantine data-loss paths

[cursor]

Summary

• Disable environment-proxy trust for Ollama semantic judge requests so validated localhost URLs cannot be redirected through ambient HTTP_PROXY/HTTPS_PROXY settings.
• Reject quarantine entries that cannot fit under the total quota before retention or eviction can delete existing evidence.
• Keep injection pipeline results blocked when quarantine storage raises OSError, matching existing quota failure behavior.
• Add regression coverage for proxy leakage, redirect/proxy request options, impossible quota writes, and quarantine storage failures.

Validation

• PYTHONPATH=src python3 -m pytest tests/test_security_regressions.py tests/test_semantic_judge_ollama.py -q -> 16 passed
• PYTHONPATH=src python3 -m pytest -q -> 1 failed, 17 passed; existing tests/test_contract_document_hash.py::test_vendored_scp_mcp_v1_contract_sha256 mismatch (got=69a40c..., expected=226f19...) is unrelated to this diff and neither the contract document nor hash test changed in this branch.