What it may solve
Single-model disable gate: hides denied models from DSH catalogs, blocks direct dispatch with an in-protocol error chunk, and exposes a settings UI for the denylist.
Imported third-party catalog description; not a Registry verification conclusion.