Plain HTTP connections started loading and filtering the CA certificate store after the dual-stack transport change. The TCP dial path never uses those certificates, but their initialization caused the first chat turn to exceed the daemon memory budget.
Build TLS options only for HTTPS. This removes the unused certificate work from HTTP connections and keeps HTTPS certificate and hostname verification intact.