lmk if you want me to slow down / focus on getting my existing prs, but I took at look at this one today (local cache read and written to even with --no-local-cache) after it burned me for a couple hours. I think I mapped out a reasonable approach in this comment
https://github.com/pantsbuild/pants/issues/21162#issuecomment-2664506771
If this sounds good I can put up a pr for it.
The flag is being bypassed because the http_source isn't implemented as a process but directly in rust, so that flag would need to be checked there. I
think this also means the remote cache is being bypassed, but thats a separate issue