Function remote_inference_allowed 

pub fn remote_inference_allowed(config: &Config) -> bool

Back-compat re-exports: keep external scc_cli::embed_cli:: paths compiling during migration (single implementation in the engine). Remote-model policy (P0, docs/SECURITY.md): repository-derived content may leave the machine only when inference.enabled AND security.allow_remote_models are both true. Loopback providers need only inference.enabled. Fails closed.