DebugBundle uploads when either the upload flag or the upload URL is set, but
the privilege gate was told only about the flag. With an MDM policy pinning the
destination the gate blanks the caller's URL, so a request carrying a URL and no
flag reached the empty-URL branch and found upload false: nothing to weaken, let
it through. The daemon then uploaded as root with TLS verification disabled on
behalf of an unprivileged caller.
A client older than the upload flag sends exactly that shape, a URL and nothing
else, so this needs no crafted request to reach.
The gate now derives the upload intent from the URL rather than trusting the
caller's flag, and DebugBundle computes it once so the gate and the local-only
early return cannot drift apart.
riccardom
676181b908