Add optional local-folder workspace with staged review and apply

Allow curl requests to any HTTPS host; remove experimental domain allowlist

Enable browser HTTP commands with CORS-aware errors and bounded requests