CVE-2026-27159

Before this fix, model-driven TTS directives accepted provider overrides by default. A reply containing "tts:provider=..." could switch TTS provider for that reply...