ctx v5.30.2

v5.30.2 — two egress fixes: provider-map data race on the OpenRouter wire, cross-origin redirects refused (W02-01, F-W1)

Patch on v5.30.1. Both changes concern what ctx sends to a model backend;
no migration, no new setting.

• OpenRouter ZDR force on the openai STREAM wire (W02-01, PR #83): a
  streamed chat over a provider_class=openrouter row now carries
  provider.zdr:true + provider.data_collection:"deny" after the extra_body
  merge, and the row's extra_headers, exactly like the non-streamed wire.
  Until now the stream went out without either.
• Pre-existing data race, same PR: the non-streamed force wrote zdr/deny
  into the row's own provider map — the pool snapshot every concurrent
  request on that backend shares. Two parallel chats over such a row could
  abort the process ("fatal error: concurrent map writes"). The force now
  writes into a clone; wire bytes unchanged.
• Cross-origin redirects (F-W1, PR #84): both pool HTTP clients follow a
  redirect only on the origin of the first request (the configured
  base_url) or as an http→https upgrade on the same host. Any other
  Location returns the 3xx to the wire (StatusError → bad request, one WARN
  "redirect refused" with both origins). Before, net/http re-sent the prompt
  body (307/308) or a GET carrying x-api-key (301–303) to whatever host the
  redirect named. A backend behind a redirect to another host must be
  configured with its final URL (docs/security.md, docs/operations.md).

Wave reports W02-01 and F-W1 in the private plan corpus.

Installation

With Go:

go install github.com/GottZ/ctx/cmd/ctx@v5.30.2

Binary download:
Download the binary for your platform (and SHA256SUMS), verify both, then install:

gh attestation verify ctx-<os>-<arch> -R GottZ/ctx   # signed build provenance
# offline: add --bundle ctx.intoto.jsonl (Sigstore bundle attached to this release)
sha256sum -c --ignore-missing SHA256SUMS            # download integrity
chmod +x ctx-*
sudo mv ctx-* /usr/local/bin/ctx