Harden URL and environment path handling

[ChanTso]

Summary

• parse and validate RedNote collection URLs by exact HTTPS hostname and /board/ path
• reject deceptive substring hosts, embedded credentials, non-HTTPS URLs, and unexpected ports
• replace filesystem resolution of CONDA_PREFIX with a pure lexical boundary check
• add focused regression tests for both CodeQL findings

Validation

• Ruff passes
• 47 tests pass
• compileall passes
• privacy cross-audit remains at zero matches
• Gitleaks reports zero findings

Closes CodeQL alerts #1 and #2 once the post-merge scan confirms the fixes.