Enforced at the runner process sandbox level before any CLI execution occurs.
Authorized targets, root domains, wildcards, and CIDR ranges (one per line):
Forbidden targets strictly blocked by runner process sandboxes: