changelog.d/4793-gov-judge-fence.md

Rama main · réplica de lectura del repositorio original.

- **The degraded governance judge no longer dials the instance judge endpoint without the trusted-endpoint fence (#4793, CodeQL #762).** When a workspace governance model fell back to the instance Ollama judge (revoked credential, or ollama without an endpoint), the call used a plain HTTP client that followed redirects and had no dial-time address check, unlike every other dial of that runtime-settable URL. It now uses the same trusted-endpoint client: loopback and LAN judges keep working; cloud metadata, link-local addresses and redirects are refused.