The pack's server still never contacts a host. The info card's button has the
browser ask civitai.com about one file by its SHA256, then the server saves
the answer beside the LoRA as <model>.civitai.info after checking it names the
same file (size, shape and hash). The old Python HTTP call stays gone.
release_preflight now allows a raw fetch() only in js/cache_guard and
js/lora_loader. SECURITY.md, AGENTS.md, the README and the LoRA Loader help
page describe the change.