Keep server-side share publish and fetch traffic on the configured OpenWork publisher so bundle links cannot steer host requests to arbitrary targets. Add a warning-backed client-side fallback for manual imports from untrusted bundle URLs.
Co-authored-by: src-opn <src-opn@users.noreply.github.com>