JR-041 is a requirement to *not* do something, so like JR-021 it can only
be verified by absence. Mirrors the server's UR-012, which is preserved
the same way.
The check looks for any *parse* of gallery data — a field name, a
property, a type — not merely for network calls: an embedding arriving
here would mean SR-005 had already been breached upstream.
TRACES: JR-041 | SR-005
