security(coverage): reject cross-origin uv redirects before any redirected request #751

Problem

The trusted uv downloader starts from a literal HTTPS URL and verifies both the final origin and the archive SHA-256. However, urllib.request.urlopen follows an HTTP redirect before response.geturl() can verify the destination. A compromised or misconfigured release origin could therefore cause one unintended request to an internal or cross-origin address even though the returned bytes would later fail the origin or digest check.

The current digest pin protects executable identity; it does not by itself prevent the redirected network side effect.

Required fix

• Replace automatic redirect following with a transport that rejects redirects before issuing a request to the target, or a custom redirect handler that validates the new URL before following it.
• Keep the initial scheme, host, path, method, headers, query, and fragment fixed and scanner-verifiable.
• Allow no file:, loopback, link-local, private-network, alternate-port, userinfo, or cross-origin target.
• Prefer no redirects at all unless a same-origin redirect is demonstrably required by the official release endpoint.
• Preserve certificate verification, bounded reads, archive SHA-256, tar member/type/size checks, executable mode, and exact version verification.
• Do not inherit ambient proxy configuration unless an explicit reviewed proxy policy is added.

TDD contract

• A 200 response from the fixed endpoint succeeds.
• 301, 302, 303, 307, and 308 responses fail before a second connection is created.
• A synthetic redirect to file:, localhost, RFC 1918, link-local, IPv6 loopback, a different public host, or a nonstandard port produces zero requests to that target.
• An HTTP error and transport exception remain bounded and secret-free.
• The static contract proves the network sink still receives only literal host/path/method values.
• Production statement and branch coverage remain 100%; all production symbols retain docstrings.

Sequencing

Address before #743 becomes ready for merge. Keep this transport hardening independent from the exact-base uv-workspace reconstruction tracked in #750.