The /_backend_models location used a literal proxy_pass, so nginx
resolved api.oroagents.com once at startup. When that CloudFront edge IP
went stale, every allowlist refresh failed; after the 15 min TTL + 60 min
stale grace, each inference call returned 503 'Inference allowlist
unavailable' and every task scored agent_error (2026-09-25: two external
validators zeroed 56 evals until restarted).

Use the configurable resolver with a variable proxy_pass, matching the
Chutes/OpenRouter locations. $is_args$args keeps ?provider=.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>