fix(tools): pin image_gen to the validated host and cover the redirect boundary (#10046)