The pull zone carries cache_vary_headers = ["User-Agent"], set before this
configuration existed. Because cdn.tf never declared it, the first apply of the
managed middleware would have removed it as a side effect.
Keep it for now: the router's only UA-dependent responses are redirects, which
are no-store, so it is redundant on paper, but it is also the second line of
defence against an R 4.6 client being served the 4.5 index. Removing it is
worth doing on its own once per-minor routing is confirmed live.