Checking an upstream fetches only the vetted address, sends a token only to its exact https origin, and runs one check at a time #3977

For: following an upstream, layer 2 of 5 (split from #3622). Source: refs/pull/3722/head, the check half of src/actions/upstream_follow.ts, and the vettedEnv export in src/origins/git-mirror.ts. This layer records what it found on the follow row (upstream head, commits behind) and opens nothing.

Done:

• [ ] checkUpstream takes the checking claim itself. A second caller while one runs is refused with "Already checking this upstream". A test runs two at once.
• [ ] ls-remote and fetch use vettedEnv with REMOTE_PROTOCOLS (https:http): the host is vetted as the mirror fetch does, and the resolved address is pinned with http.curloptResolve. A test sees the pin in the git environment.
• [ ] A connected origin's token goes only when the upstream is https: and its URL.origin equals the origin's webUrl origin. mayCarryCredential is checked at save and at each check. Tests: same scheme/host/port only, and a recording http server sees no Authorization for an http:// upstream on a connected host.
• [ ] bun x tsc --noEmit and bun test test/upstream_follow.test.ts pass.

Files: src/actions/upstream_follow.ts (new, check only), src/origins/git-mirror.ts, test/upstream_follow.test.ts. Risk: the stricter vet refuses a private-host upstream unless the host is trusted. Say so in the pull. If the check fails where it ran and not in the change, say so in the pull.

Parked by the crew: the check failed ("bun scripts/hollow.ts says so and exits 0") and the decider saw no point in another try (pull #4044 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.