Following an upstream sends a credential only to its exact https origin, fetches the vetted address, and runs one check at a time #3557

For: the first, landable piece of a repository following its upstream (split from #3442; pull #3468 holds the work). It is the setting, the check every 30 minutes and on 'Check upstream now', a clean merge as a pull, a conflict as a converge run — made safe.

Done:

• [ ] A connected origin's token is used only when new URL(follow.url).origin === new URL(origin.webUrl).origin and that origin is https, checked when the setting is saved and again at each check (rows written by migrate included). An http:// upstream on a connected host fetches anonymously. A test proves no Authorization reaches an http upstream.
• [ ] The fetch is pinned to the address the private-host vet resolved, as origins/git-mirror.ts vettedEnv does (remoteGitEnv(authEnv, pinFor(url, ip), PROTOCOLS)), so a second DNS answer cannot redirect it. A test shows the pin in the git environment.
• [ ] checkUpstream takes the checking claim itself, so the timer and every manual door share it; a second caller while one runs is refused with 'already checking' and opens nothing. A test runs two checks at once and finds one pull.
• [ ] Everything else pull #3468 already proves still passes (test/upstream_follow.test.ts, test/migrate.test.ts).

Files: src/core/upstream_follow.ts, src/actions/upstream_follow.ts, test/upstream_follow.test.ts. Risk: the credential rule must not break the private-upstream case on an https origin; test both.

Start from branch torque/3442-a-repository-follows-its-upstream-new-up (head aafbd4b, from closed pull #3468). It already has the setting, the check, the pull-or-converge path and 11 green tests. What is left is the three safety changes listed above. Keep the terminal screen changes on that branch out of this pull, because #3559 owns them.

replaced by #3622. It is the same checklist, plus the three high findings from the reviews of #3565 (git:// refused, the event admins-only, no planted upstream branch), and it starts from that pull's branch.