farm: close redirect, sink-validation, and diagnostic leaks

[SUaDtL]

Observed behavior

The focused SD-02 re-review of plugins/ca/tools/farm.ts confirmed four related transport/diagnostic defects:

1. Both API POSTs relied on fetch's default redirect-following behavior. A 307/308 could forward the POST body from a validated endpoint to an unvalidated or cleartext destination.
2. The exported httpWorker/runTask and makeEntitlementProbe seams accepted caller-supplied base URLs without enforcing assertSecureBaseUrl at the fetch-producing boundary.
3. HTTPS URLs containing userinfo were accepted. Node fetch then rejected them with an error containing the credential-bearing URL, which could flow into retry/report output.
4. Rejected configuration and provider response bodies were reflected into errors or stderr without a confidentiality guarantee.

The pre-fix suite passed 166/166 because HTTPS userinfo acceptance was explicitly expected and the redirect/sink boundaries were not covered.

Expected behavior

• Reject userinfo for every scheme without reflecting the raw value.
• Validate at every fetch-producing boundary as well as during top-level config resolution.
• Refuse automatic redirects (or manually validate every hop before reconstructing a request).
• Never copy provider-controlled bodies or secret-bearing endpoint components into logs, retry prompts, or reports.
• Preserve ordinary HTTPS and the documented bare-loopback HTTP test exception.

Acceptance evidence

• Regression tests fail against the pre-fix behavior for each defect.
• Both request options set redirect: error.
• Direct external-HTTP invocations do not call fetch.
• HTTPS userinfo and malformed control-bearing input are rejected without disclosure.
• Provider response bodies and query credentials do not appear in diagnostic output.
• Full farm typecheck/test/build and repository CI pass.

Found during v2.security.0003 focused security review on 2026-07-20.