fluksio-worker now refuses ws:// and http:// engine and artifact URLs unless they are loopback or --insecure is given; the engine still accepts both. An artifact reference must be sha256: plus 64 hex digits before it is joined into a path, and node code gets the host environment through the engine's credential denylist instead of all of it.